https://github.com/python/cpython/commit/3beccbe0074e927767c1f9c2f36546709f8bb072 commit: 3beccbe0074e927767c1f9c2f36546709f8bb072 branch: 3.14 author: Miss Islington (bot) <[email protected]> committer: JelleZijlstra <[email protected]> date: 2026-10-19T21:36:44Z summary:
[3.14] gh-159739: Release SSL resources on error paths (GH-159745) (#159762) gh-159739: Release SSL resources on error paths (GH-159745) Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. (cherry picked from commit b2b0a337098e60fa9f84df7b53d191fbd8d4fc67) Co-authored-by: Jelle Zijlstra <[email protected]> Co-authored-by: Jelle Zijlstra <[email protected]> files: A Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst M Modules/_ssl.c M Modules/_ssl/debughelpers.c diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 000000000000000..2d723061b9369d8 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 90bcb6fd5dc6aca..f1b99168fcd29d4 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1512,6 +1512,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index 177019ea985af61..b15caa1084deb6d 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -220,6 +220,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1; _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
