Fix memory leak in asn_mime multi_split

The bpart is not freed if BIO_write or BIO_puts fails. It also makes the
error handling of that case consistent with other parts freeing the
bpart.

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Fri May  1 13:06:32 2026
(Merged from https://github.com/openssl/openssl/pull/31033)

diff --git a/crypto/asn1/asn_mime.c b/crypto/asn1/asn_mime.c
index 3d667646aa379fbfc462bfaecd650f38829012c9..af79f27bdafe53570dfbdd133079c21f07810d64 100644 (file)
--- a/crypto/asn1/asn_mime.c
+++ b/crypto/asn1/asn_mime.c
@@ -660,10 +660,8 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
                     return 0;
                 BIO_set_mem_eof_return(bpart, 0);
             }
-            if (!sk_BIO_push(parts, bpart)) {
-                BIO_free(bpart);
-                return 0;
-            }
+            if (!sk_BIO_push(parts, bpart))
+                goto err;
             return 1;
         } else if (part != 0) {
             /* Strip (possibly CR +) LF from linebuf */
@@ -671,10 +669,8 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
             if (first) {
                 first = 0;
                 if (bpart)
-                    if (!sk_BIO_push(parts, bpart)) {
-                        BIO_free(bpart);
-                        return 0;
-                    }
+                    if (!sk_BIO_push(parts, bpart))
+                        goto err;
                 bpart = BIO_new(BIO_s_mem());
                 if (bpart == NULL)
                     return 0;
@@ -688,17 +684,18 @@ static int multi_split(BIO *bio, int flags, const char *bound, STACK_OF(BIO) **r
 #endif
                     || (flags & SMIME_CRLFEOL) != 0) {
                     if (BIO_puts(bpart, "\r\n") < 0)
-                        return 0;
+                        goto err;
                 } else {
                     if (BIO_puts(bpart, "\n") < 0)
-                        return 0;
+                        goto err;
                 }
             }
             eol = next_eol;
             if (len > 0 && BIO_write(bpart, linebuf, len) != len)
-                return 0;
+                goto err;
         }
     }
+err:
     BIO_free(bpart);
     return 0;
 }