https://github.com/python/cpython/commit/b2b0a337098e60fa9f84df7b53d191fbd8d4fc67 commit: b2b0a337098e60fa9f84df7b53d191fbd8d4fc67 branch: main author: Jelle Zijlstra <[email protected]> committer: gpshead <[email protected]> date: 2026-10-19T20:42:04Z summary:
gh-159739: Release SSL resources on error paths (GH-159745) Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. Co-authored-by: Jelle Zijlstra <[email protected]> files: A Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst M Modules/_ssl.c M Modules/_ssl/debughelpers.c diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 000000000000000..2d723061b9369d8 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 6d43e59f36df7e3..ee0df146421d7f8 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1549,6 +1549,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index e8da76907971ed1..0e5422b73a89d4f 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -232,6 +232,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1; _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
