free item after sk_push fail

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@openssl.org>

diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
index 595c5e4cb18152bd572a20ca6fc7f007315d221e..0e0759f54bfb29872c37cec607e8b424a46aa72b 100644 (file)
--- a/crypto/asn1/tasn_dec.c
+++ b/crypto/asn1/tasn_dec.c
@@ -623,6 +623,7 @@ static int asn1_template_noexp_d2i(ASN1_VALUE **val,
             len -= p - q;
             if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) {
                 ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I, ERR_R_MALLOC_FAILURE);
+                ASN1_item_free(skfield, ASN1_ITEM_ptr(tt->item));
                 goto err;
             }
         }