Commit d9f5cb8965 for openssl.org

commit d9f5cb8965cb56414b97a95a101dc68e08f26476
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Thu Aug 6 01:52:45 2026 +0200

    Fix ASN1_TYPE memory leak in asn1_multi()

    In asn1_gen.c `asn1_multi()` function variable allocated as
    `ASN1_TYPE *typ = generate_v3()` is not freed if
    `if (!sk_ASN1_TYPE_push(sk, typ))` branch fails.

    Bug found by x509v3 fuzzer MFAIL test.
    Example input:
    ```
    [default]
    1.2.3.4 = ASN1:SEQUENCE:items

    [items]
    value = INTEGER:1
    ```

    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Fri Aug 14 09:42:52 2026
    Merged-from: https://github.com/openssl/openssl/pull/32206

diff --git a/crypto/asn1/asn1_gen.c b/crypto/asn1/asn1_gen.c
index 0cf4f8dcef..0cccdd4257 100644
--- a/crypto/asn1/asn1_gen.c
+++ b/crypto/asn1/asn1_gen.c
@@ -426,8 +426,11 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
                 depth + 1, perr);
             if (!typ)
                 goto bad;
-            if (!sk_ASN1_TYPE_push(sk, typ))
+
+            if (!sk_ASN1_TYPE_push(sk, typ)) {
+                ASN1_TYPE_free(typ);
                 goto bad;
+            }
         }
     }