From c4179dd3123cb401635b342eb0f45c688ac7e0f1 Mon Sep 17 00:00:00 2001 From: Jelle Zijlstra Date: Mon, 19 Oct 2026 13:42:04 -0700 Subject: [PATCH] gh-159739: Release SSL resources on error paths (GH-159745) Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. (cherry picked from commit b2b0a337098e60fa9f84df7b53d191fbd8d4fc67) Co-authored-by: Jelle Zijlstra Co-authored-by: Jelle Zijlstra --- .../next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst | 2 ++ Modules/_ssl.c | 1 + Modules/_ssl/debughelpers.c | 1 + 3 files changed, 4 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 00000000000000..2d723061b9369d --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 90bcb6fd5dc6ac..f1b99168fcd29d 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1512,6 +1512,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index 177019ea985af6..b15caa1084deb6 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -220,6 +220,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1;