Commit e6c03cbcc9 for openssl.org

commit e6c03cbcc9aacce38e283541016a9179bf54e965
Author: Neil Horman <nhorman@openssl.org>
Date:   Wed Sep 9 15:00:21 2026 -0400

    use BUF_MEM_free instead of OPENSSL_free to free BUF_MEM in str_copy

    While reviewing a PR, I noticed that str_copy in conf_def.c allocates a
    BUF_MEM with BUF_MEM_free, but frees it with OPENSSL_free.  While this
    is fine here since we take ownership of the buf mem data pointer, it was
    a bit hard to parse.

    Change it to follow the usual pattern of orphaning the BUF_MEM data by
    setting buf->data to NULL prior to using the standard BUF_MEM_free call

    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Todd Short <todd.short@me.com>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    MergeDate: Fri Sep 11 20:55:00 2026
    (Merged from https://github.com/openssl/openssl/pull/32774)

diff --git a/crypto/conf/conf_def.c b/crypto/conf/conf_def.c
index 2312473675..f414add6a8 100644
--- a/crypto/conf/conf_def.c
+++ b/crypto/conf/conf_def.c
@@ -643,6 +643,7 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from)
     int q, r, rr = 0, to = 0;
     char *s, *e, *rp, *p, *rrp, *np, *cp, v;
     BUF_MEM *buf;
+    int ret = 0;

     if ((buf = BUF_MEM_new()) == NULL)
         return 0;
@@ -783,11 +784,12 @@ static int str_copy(CONF *conf, char *section, char **pto, char *from)
     buf->data[to] = '\0';
     OPENSSL_free(*pto);
     *pto = buf->data;
-    OPENSSL_free(buf);
-    return 1;
+    /* Take ownership of the buf mem data */
+    buf->data = NULL;
+    ret = 1;
 err:
     BUF_MEM_free(buf);
-    return 0;
+    return ret;
 }

 #ifndef OPENSSL_NO_POSIX_IO