https://github.com/python/cpython/commit/40abc658a7a91b64b5e979349ec697ac04c0965b commit: 40abc658a7a91b64b5e979349ec697ac04c0965b branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: gpshead <[email protected]> date: 2026-10-19T21:48:43Z summary:
[3.15] gh-159739: Release SSL resources on error paths (GH-159745) (#159761) gh-159739: Release SSL resources on error paths (GH-159745) Free decoded subject alternative names when certificate conversion fails, and close the key log file if the BIO allocation fails. Backport to 3.15 and 3.14. (cherry picked from commit b2b0a337098e60fa9f84df7b53d191fbd8d4fc67) Co-authored-by: Jelle Zijlstra <[email protected]> Co-authored-by: Jelle Zijlstra <[email protected]> files: A Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst M Modules/_ssl.c M Modules/_ssl/debughelpers.c diff --git a/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst new file mode 100644 index 000000000000000..2d723061b9369d8 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-19-19-33-35.gh-issue-159739.a1c3c7.rst @@ -0,0 +1,2 @@ +Fix resource leaks in :mod:`ssl` when certificate conversion or key log setup +fails. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 21b031d0570f4a4..5d0a66e9a132fea 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1576,6 +1576,7 @@ _get_peer_alt_names (_sslmodulestate *state, X509 *certificate) { fail: + sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); if (biobuf != NULL) BIO_free(biobuf); diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c index f5e48b337fbda0a..d601a07bffe724d 100644 --- a/Modules/_ssl/debughelpers.c +++ b/Modules/_ssl/debughelpers.c @@ -229,6 +229,7 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg, self->keylog_bio = BIO_new_fp(fp, BIO_CLOSE | BIO_FP_TEXT); if (self->keylog_bio == NULL) { + fclose(fp); PyErr_SetString(get_state_ctx(self)->PySSLErrorObject, "Can't malloc memory for keylog file"); return -1; _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
