From 28adea95975c3ea53fc590efda35dee13efd4767 Mon Sep 17 00:00:00 2001
From: slontis <shane.lontis@oracle.com>
Date: Fri, 24 Jun 2022 14:01:07 +1000
Subject: [PATCH] Fix memory leak in ossl_rsa_fromdata.

Occurs if a malloc failure happens inside collect_numbers()

Reported via #18365

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18646)
---
 crypto/rsa/rsa_backend.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/crypto/rsa/rsa_backend.c b/crypto/rsa/rsa_backend.c
index b69c94fc11..bc658d9d30 100644
--- a/crypto/rsa/rsa_backend.c
+++ b/crypto/rsa/rsa_backend.c
@@ -49,9 +49,12 @@ static int collect_numbers(STACK_OF(BIGNUM) *numbers,
         if (p != NULL) {
             BIGNUM *tmp = NULL;
 
-            if (!OSSL_PARAM_get_BN(p, &tmp)
-                || sk_BIGNUM_push(numbers, tmp) == 0)
+            if (!OSSL_PARAM_get_BN(p, &tmp))
                 return 0;
+            if (sk_BIGNUM_push(numbers, tmp) == 0) {
+                BN_clear_free(tmp);
+                return 0;
+            }
         }
     }