Fix memleak in hashtable free if flush fails

This happens because free_oldmd is not run when flush fails

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu May 14 09:26:11 2026
(Merged from https://github.com/openssl/openssl/pull/31163)

diff --git a/crypto/hashtable/hashtable.c b/crypto/hashtable/hashtable.c
index 83fbc1ac7363608c75336e9aea74459eaebc2f97..7b3da99c6d0c5b1831f462a6b7068ea368465e9a 100644 (file)
--- a/crypto/hashtable/hashtable.c
+++ b/crypto/hashtable/hashtable.c
@@ -363,19 +363,25 @@ int ossl_ht_flush(HT *h)
 
 void ossl_ht_free(HT *h)
 {
+    int flush_ok;
+
     if (h == NULL)
         return;
 
     ossl_ht_write_lock(h);
-    ossl_ht_flush_internal(h);
+    flush_ok = ossl_ht_flush_internal(h);
     ossl_ht_write_unlock(h);
     /* Freeing the lock does a final sync for us */
     if (!h->config.no_rcu) {
         CRYPTO_THREAD_lock_free(h->atomic_lock);
         ossl_rcu_lock_free(h->lock);
     }
-    OPENSSL_free(h->md->neighborhood_ptr_to_free);
-    OPENSSL_free(h->md);
+    if (flush_ok) {
+        OPENSSL_free(h->md->neighborhood_ptr_to_free);
+        OPENSSL_free(h->md);
+    } else {
+        free_oldmd(h->md);
+    }
     OPENSSL_free(h);
     return;
 }