Commit 6fbc443ad5 for openssl.org

commit 6fbc443ad53299972c5eb71ea78f6422de23d3d1
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Tue Aug 4 19:52:50 2026 +0200

    Fix memory leaks in x509v3 config handling

    Duplicate integer value fields in the policyConstraints,
    basicConstraints and basicAttConstraints extensions overwrite
    previously allocated ASN1_INTEGER values without freeing them.

    Found by : x509v3 fuzzer

    Example 1: (crypto/x509/v3_pcons.c)
    ```
    [default]
    policyConstraints = requireExplicitPolicy:1,requireExplicitPolicy:2
    ```

    Example 2: (crypto/x509/v3_bcons.c)
    ```
    [default]
    basicConstraints = pathlen:1,pathlen:2
    ```

    Example 3: (crypto/x509/v3_battcons.c)
    ```
    [default]
    basicAttConstraints = pathlen:1,pathlen:2
    ```
    Assisted-by: ChatGPT:gpt-5.6

    Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Sun Aug  9 04:06:32 2026
    (Merged from https://github.com/openssl/openssl/pull/32181)

diff --git a/crypto/x509/v3_battcons.c b/crypto/x509/v3_battcons.c
index 2905fb4398..7bcca27537 100644
--- a/crypto/x509/v3_battcons.c
+++ b/crypto/x509/v3_battcons.c
@@ -73,6 +73,8 @@ static OSSL_BASIC_ATTR_CONSTRAINTS *v2i_OSSL_BASIC_ATTR_CONSTRAINTS(
             if (!X509V3_get_value_bool(val, &battcons->authority))
                 goto err;
         } else if (strcmp(val->name, "pathlen") == 0) {
+            ASN1_INTEGER_free(battcons->pathlen);
+            battcons->pathlen = NULL;
             if (!X509V3_get_value_int(val, &battcons->pathlen))
                 goto err;
         } else {
diff --git a/crypto/x509/v3_bcons.c b/crypto/x509/v3_bcons.c
index 21e819542d..da438346b8 100644
--- a/crypto/x509/v3_bcons.c
+++ b/crypto/x509/v3_bcons.c
@@ -72,6 +72,8 @@ static BASIC_CONSTRAINTS *v2i_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method,
             if (!X509V3_get_value_bool(val, &bcons->ca))
                 goto err;
         } else if (strcmp(val->name, "pathlen") == 0) {
+            ASN1_INTEGER_free(bcons->pathlen);
+            bcons->pathlen = NULL;
             if (!X509V3_get_value_int(val, &bcons->pathlen))
                 goto err;
         } else {
diff --git a/crypto/x509/v3_pcons.c b/crypto/x509/v3_pcons.c
index e8c3d242d9..376be44608 100644
--- a/crypto/x509/v3_pcons.c
+++ b/crypto/x509/v3_pcons.c
@@ -67,9 +67,13 @@ static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method,
     for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
         val = sk_CONF_VALUE_value(values, i);
         if (strcmp(val->name, "requireExplicitPolicy") == 0) {
+            ASN1_INTEGER_free(pcons->requireExplicitPolicy);
+            pcons->requireExplicitPolicy = NULL;
             if (!X509V3_get_value_int(val, &pcons->requireExplicitPolicy))
                 goto err;
         } else if (strcmp(val->name, "inhibitPolicyMapping") == 0) {
+            ASN1_INTEGER_free(pcons->inhibitPolicyMapping);
+            pcons->inhibitPolicyMapping = NULL;
             if (!X509V3_get_value_int(val, &pcons->inhibitPolicyMapping))
                 goto err;
         } else {