Commit a58528d130 for openssl.org

commit a58528d130773485e62bb647f6cc8ffc3b440b51
Author: Greensi7 <adam.tabak04@gmail.com>
Date:   Wed Aug 12 12:48:33 2026 +0200

    Fix error handling in asn1_multi()

    Free the partially constructed ASN1_TYPE and return NULL when
    ASN1_STRING_type_new() fails. Previously asn1_multi() returned an
    incomplete object.

    Found by x509v3 mfail regression test.

    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Merge-date: Mon Sep  7 14:08:12 2026
    Merged-from: https://github.com/openssl/openssl/pull/32330

diff --git a/crypto/asn1/asn1_gen.c b/crypto/asn1/asn1_gen.c
index 0cccdd4257..7dfe661977 100644
--- a/crypto/asn1/asn1_gen.c
+++ b/crypto/asn1/asn1_gen.c
@@ -447,8 +447,11 @@ static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf,
         goto bad;
     if ((ret = ASN1_TYPE_new()) == NULL)
         goto bad;
-    if ((ret->value.asn1_string = ASN1_STRING_type_new(utype)) == NULL)
+    if ((ret->value.asn1_string = ASN1_STRING_type_new(utype)) == NULL) {
+        ASN1_TYPE_free(ret);
+        ret = NULL;
         goto bad;
+    }

     ret->type = utype;
     ret->value.asn1_string->data = der;