From 96aeed552bedc8bb4daf652d89371c868bff1203 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Mon, 19 Oct 2026 12:34:29 -0700 Subject: [PATCH] gh-159739: Release SSL resources on error paths Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. --- .../next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst | 2 ++ Modules/_ssl.c | 1 + Modules/_ssl/debughelpers.c | 1 + 3 files changed, 4 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 000000000000000..2d723061b9369d8 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 6d43e59f36df7e3..ee0df146421d7f8 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1549,6 +1549,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index e8da76907971ed1..0e5422b73a89d4f 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -232,6 +232,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1;