Commit 3e16cec668 for openssl.org

commit 3e16cec66849b90ed0f922310c7b04b49f7c602e
Author: Jakub Jelen <jjelen@redhat.com>
Date:   Tue Nov 10 15:59:01 2026 +0100

    crypto/store/store_result.c: fix EVP_SKEYMGMT leak in try_skey()

    When a store loader returns a symmetric key by reference, try_skey()
    fetches the SKEYMGMT from the loader's provider and passes
    it to EVP_SKEY_import_SKEYMGMT().  The new EVP_SKEY takes its own
    reference, so the reference from the fetch was never released.
    That leaked one EVP_SKEYMGMT per secret key loaded,
    e.g. with "openssl storeutl pkcs11:" through pkcs11-provider.

    Fixes: 1b0f21f0555c "Implementing store support for EVP_SKEY"
    Assisted-by: Claude Code:claude-opus-5-5
    Signed-off-by: Jakub Jelen <jjelen@redhat.com>
    Reviewed-by: Simo Sorce <simo@redhat.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
    Merge-date: Thu Nov 12 10:17:59 2026
    Merged-from: https://github.com/openssl/openssl/pull/33643

diff --git a/crypto/store/store_result.c b/crypto/store/store_result.c
index 0a0198ee32..a8b5c29fcc 100644
--- a/crypto/store/store_result.c
+++ b/crypto/store/store_result.c
@@ -740,6 +740,8 @@ static int try_skey(struct extracted_param_data_st *data, OSSL_STORE_INFO **v,
         params[1] = OSSL_PARAM_construct_end();

         skey = EVP_SKEY_import_SKEYMGMT(libctx, skeymgmt, OSSL_SKEYMGMT_SELECT_ALL, params);
+        /* The EVP_SKEY holds its own reference to the SKEYMGMT */
+        EVP_SKEYMGMT_free(skeymgmt);
     }

     if (skey != NULL)