Commit 5922e34b19 for openssl.org

commit 5922e34b192cef0837a5e7ac8200afd9b97b7624
Author: Jakub Zelenka <jakub.zelenka@openssl.foundation>
Date:   Wed Nov 4 19:50:55 2026 +0100

    x509: fix leak of issuer alt names on reserve failure in copy_issuer()

    When copying the issuer subject alt names into the subject issuer alt
    name extension, a failure to reserve space in the destination stack
    freed only the decoded stack and leaked all the names it still owned.

    Free the names together with the stack on the error path.

    Found by the fuzz mfail CI job on the x509v3 corpus.

    Fixes: aa066b9e6e44 "Add more functionality to issuer alt name and subject alt name. New options to include email addresses from DN and copy details from issuer certificate. Include examples in openssl.cnf, update Win32 ordinals."
    Complements: fa856b0ce0f5 "Fix memory leak on failure in copy_issuer()"
    Assisted-by: Claude:claude-fable-5-1
    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Wed Nov  4 22:37:55 2026
    Merged-from: https://github.com/openssl/openssl/pull/33542

diff --git a/crypto/x509/v3_san.c b/crypto/x509/v3_san.c
index 0defca074d..b5e7aa3bc5 100644
--- a/crypto/x509/v3_san.c
+++ b/crypto/x509/v3_san.c
@@ -380,7 +380,7 @@ static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
     return 1;

 err:
-    sk_GENERAL_NAME_free(ialt);
+    sk_GENERAL_NAME_pop_free(ialt, GENERAL_NAME_free);
     return 0;
 }