fix: free EVP_PKEY_CTX leak in _new_key_from_parameters()

[toddr-bot]

What

Free leaked EVP_PKEY_CTX, OSSL_PARAM_BLD, and OSSL_PARAM resources in _new_key_from_parameters() on the OpenSSL 3.x code path.

Why

Three memory leaks on every call to _new_key_from_parameters() with OpenSSL 3.x:

• test_ctx — allocated for EVP_PKEY_check(), never freed
• pctx — allocated for EVP_PKEY_fromdata(), never freed in either branch
• params_build/params — freed in the if(p||q) branch but leaked in the else branch

How

• test_ctx: Capture EVP_PKEY_check() result, free test_ctx immediately, then THROW on failure. This ensures cleanup even when the check fails.
• pctx/params_build/params: Free after EVP_PKEY_fromdata() in both branches (if/else), NULL the pointers to prevent double-free on fall-through.
• Error path: Added #if-guarded cleanup in err: label so THROW() jumps also free these resources. The NULL-after-free in normal paths makes this safe.

All three OpenSSL free functions (EVP_PKEY_CTX_free, OSSL_PARAM_BLD_free, OSSL_PARAM_free) are documented as no-ops on NULL input.

Testing

• Full test suite passes: 318 tests across 10 files (on OpenSSL 1.1.1k build host)
• The 3.x code path is compile-tested but not runtime-tested on this host — needs OpenSSL 3.x CI

🤖 Generated with Claude Code

---

Quality Report

Changes: 1 file changed, 18 insertions(+), 1 deletion(-)

Code scan: clean

Tests: passed (OK)

Branch hygiene: clean

Generated by Kōan post-mission quality pipeline

[atoomic]

@toddr-bot rebase

[toddr-bot]

Rebase: fix: free EVP_PKEY_CTX leak in _new_key_from_parameters()

Branch koan.toddr.bot/fix-evp-pkey-ctx-leak rebased onto main and force-pushed.

Diff: 1 file changed, 1 insertion(+), 4 deletions(-)

Review feedback was analyzed and applied.

Actions

• Resolved merge conflicts (1 round(s))
• Rebased koan.toddr.bot/fix-evp-pkey-ctx-leak onto upstream/main
• Force-pushed koan.toddr.bot/fix-evp-pkey-ctx-leak to origin

---

Automated by Kōan

[timlegge]

@toddr-bot review:

perl -I blib/lib/ -I blib/arch/ t/bignum.t
1..64
ok 1 - new_key_from_parameters(n,e,d,p,q) returns an object
ok 2 - full key: n matches expected
ok 3 - full key: e matches expected
ok 4 - full key: d matches expected
ok 5 - full key: p matches expected
ok 6 - full key: q matches expected
ok 7 - full key: dmp1 matches expected
ok 8 - full key: dmq1 matches expected
ok 9 - full key: iqmp matches expected
ok 10 - encrypt produces expected ciphertext
ok 11 - decrypt recovers original plaintext
ok 12 - private_encrypt produces expected plaintext
ok 13 - public_decrypt produces expected ciphertext
ok 14 - public key returns 8 parameters
ok 15 - public key: n matches expected
ok 16 - public key: e matches expected
ok 17 - public key: d matches expected
ok 18 - public key: p matches expected
ok 19 - public key: q matches expected
ok 20 - public key: dmp1 matches expected
ok 21 - public key: dmq1 matches expected
ok 22 - public key: iqmp matches expected
ok 23 - from (n,e,d,p): n matches expected
ok 24 - from (n,e,d,p): e matches expected
ok 25 - from (n,e,d,p): d matches expected
ok 26 - from (n,e,d,p): p matches expected
ok 27 - from (n,e,d,p): q matches expected
ok 28 - from (n,e,d,p): dmp1 matches expected
ok 29 - from (n,e,d,p): dmq1 matches expected
ok 30 - from (n,e,d,p): iqmp matches expected
ok 31 - from (n,e,d,undef,q): n matches expected
ok 32 - from (n,e,d,undef,q): e matches expected
ok 33 - from (n,e,d,undef,q): d matches expected
ok 34 - from (n,e,d,undef,q): p matches expected
ok 35 - from (n,e,d,undef,q): q matches expected
ok 36 - from (n,e,d,undef,q): dmp1 matches expected
ok 37 - from (n,e,d,undef,q): dmq1 matches expected
ok 38 - from (n,e,d,undef,q): iqmp matches expected
ok 39 - from (n,e): n matches expected
ok 40 - from (n,e): e matches expected
ok 41 - from (n,e): d matches expected
ok 42 - from (n,e): p matches expected
ok 43 - from (n,e): q matches expected
ok 44 - from (n,e): dmp1 matches expected
ok 45 - from (n,e): dmq1 matches expected
ok 46 - from (n,e): iqmp matches expected
ok 47 - from (n,e,d): n matches expected
ok 48 - from (n,e,d): e matches expected
ok 49 - from (n,e,d): d matches expected
ok 50 - from (n,e,d): p matches expected
ok 51 - from (n,e,d): q matches expected
ok 52 - from (n,e,d): dmp1 matches expected
ok 53 - from (n,e,d): dmq1 matches expected
ok 54 - from (n,e,d): iqmp matches expected
ok 55 - from (n,e,undef,p): n matches expected
ok 56 - from (n,e,undef,p): e matches expected
ok 57 - from (n,e,undef,p): d matches expected
ok 58 - from (n,e,undef,p): p matches expected
ok 59 - from (n,e,undef,p): q matches expected
ok 60 - from (n,e,undef,p): dmp1 matches expected
ok 61 - from (n,e,undef,p): dmq1 matches expected
ok 62 - from (n,e,undef,p): iqmp matches expected
free(): double free detected in tcache 2
Aborted (core dumped)

[toddr-bot]

❌ Permission denied. Only users with write access can trigger bot commands.

[timlegge]

@toddr I can't give your bot commands

Tell it
if (pctx) EVP_PKEY_CTX_free(pctx);

needs to be followed with

pctx = NULL:

[timlegge]

@Koan-Bot @toddr-bot review

[timlegge]

need changes as perl comment

pcrx = NULL;

[atoomic]

@toddr-bot rebase

[toddr-bot]

Rebase: fix: free EVP_PKEY_CTX leak in _new_key_from_parameters()

Branch koan.toddr.bot/fix-evp-pkey-ctx-leak rebased onto main and force-pushed.

Diff: 1 file changed, 3 insertions(+), 6 deletions(-)

Review feedback was analyzed and applied.

Actions

• Rebased koan.toddr.bot/fix-evp-pkey-ctx-leak onto upstream/main
• Applied review feedback
• Force-pushed koan.toddr.bot/fix-evp-pkey-ctx-leak to origin
• CI passed

CI

CI passed.

---

Automated by Kōan

[timlegge]

Looks fine now

[toddr-bot]

❌ Permission denied. Only users with write access can trigger bot commands.