From 08c91988d1d2e4800ed551ce0aefce6178e7d958 Mon Sep 17 00:00:00 2001
From: Karel Miko <karel.miko@gmail.com>
Date: Thu, 16 Apr 2026 22:38:37 +0200
Subject: [PATCH] fix memory leak (or use-after-free) from previous commit

---
 src/pk/asn1/x509/x509_extensions.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/pk/asn1/x509/x509_extensions.c b/src/pk/asn1/x509/x509_extensions.c
index 4f231b9a..155adaae 100644
--- a/src/pk/asn1/x509/x509_extensions.c
+++ b/src/pk/asn1/x509/x509_extensions.c
@@ -522,19 +522,23 @@ static int s_get_ce_value(const ltc_asn1_list *os, st_ce_value *ce)
          return err;
       }
       if (value->type != LTC_ASN1_SEQUENCE) {
-         err = CRYPT_INVALID_PACKET;
-         goto err_out;
+         der_free_sequence_flexi(value);
+         return CRYPT_INVALID_PACKET;
       } else {
          err = ce->ce->u.ce.handler(value, &ce->value);
       }
-      der_free_sequence_flexi(value);
+      if (err != CRYPT_OK) {
+         der_free_sequence_flexi(value);
+         return err;
+      }
+      /* store the flexi tree root so it can be freed in s_free_extension, handlers store pointers into this tree */
+      ce->value.asn1 = value;
    } else {
       err = ce->ce->u.ce.handler(os, &ce->value);
    }
    if (err == CRYPT_OK) {
       ce->value.type = ce->ce->detail;
    }
-err_out:
    return err;
 }
 
@@ -545,15 +549,19 @@ static LTC_INLINE void s_free_extension(const ltc_x509_extension *ext)
          s_free(ext->u.authority_key_id.key_identifier.str);
          s_free(ext->u.authority_key_id.authority_cert_issuer.str);
          s_free(ext->u.authority_key_id.authority_cert_serial_number.str);
+         der_free_sequence_flexi((void*)ext->asn1);
          break;
       case LTC_X509_CE_SUBJECT_KEY_ID:
          s_free(ext->u.subject_key_identifier.str);
          break;
       case LTC_X509_CE_SUBJECT_ALT_NAME:
          s_free_x509_string_array(ext->u.subject_alt_name.names, ext->u.subject_alt_name.names_num);
+         der_free_sequence_flexi((void*)ext->asn1);
          break;
       case LTC_X509_CE_BASIC_CONSTRAINTS:
       case LTC_X509_CE_EXT_KEY_USAGE:
+         der_free_sequence_flexi((void*)ext->asn1);
+         break;
       case LTC_X509_CE_KEY_USAGE:
       default:
          break;