From 2e61ab0c89a1dc71dea35bcc13f54a14c9744262 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Mon, 19 Oct 2026 13:42:04 -0700 Subject: [PATCH] gh-159739: Release SSL resources on error paths (GH-159745) Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. (cherry picked from commit b2b0a337098e60fa9f84df7b53d191fbd8d4fc67) Co-authored-by: Jelle Zijlstra Co-authored-by: Jelle Zijlstra --- .../next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst | 2 ++ Modules/_ssl.c | 1 + Modules/_ssl/debughelpers.c | 1 + 3 files changed, 4 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 000000000000000..2d723061b9369d8 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 21b031d0570f4a4..5d0a66e9a132fea 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1576,6 +1576,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index f5e48b337fbda0a..d601a07bffe724d 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -229,6 +229,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1;