As pointed out by tb@ I forgot about taking care of free'ing finalbuf if kn_encode_base64 fails.
Revised diff below: Index: signature.c =================================================================== RCS file: /cvs/src/lib/libkeynote/signature.c,v retrieving revision 1.25 diff -u -p -u -r1.25 signature.c --- signature.c 23 Dec 2015 21:15:58 -0000 1.25 +++ signature.c 9 May 2017 12:41:49 -0000 @@ -988,11 +988,11 @@ keynote_sign_assertion(struct assertion return NULL; } - if ((slen = kn_encode_base64(sbuf, slen, finalbuf, - 2 * slen)) == -1) - { - free(sbuf); - return NULL; + slen = kn_encode_base64(sbuf, slen, finalbuf, 2 * slen); + free(sbuf); + if (slen == -1) { + free(finalbuf); + return NULL; } break;