Free allocated stack of found exts

Author: samuel40791765

crypto/x509/x509_vfy.c

@@ -598,6 +598,7 @@ static int check_custom_critical_extensions(X509_STORE_CTX *ctx, X509 *x) {
         if (OBJ_cmp(ext->object, known_ext) == 0) {
           found = 1;
           if (!sk_ASN1_OBJECT_push(found_exts, known_ext)) {
+            sk_ASN1_OBJECT_pop_free(found_exts, ASN1_OBJECT_free);
             return 0;
           }
           break;
@@ -606,6 +607,7 @@ static int check_custom_critical_extensions(X509_STORE_CTX *ctx, X509 *x) {
 
       if (!found) {
         // If any critical extension isn't in our known list, return early.
+        sk_ASN1_OBJECT_pop_free(found_exts, ASN1_OBJECT_free);
         return 0;
       }
     }
@@ -615,13 +617,15 @@ static int check_custom_critical_extensions(X509_STORE_CTX *ctx, X509 *x) {
   // If we get here, all unknown critical extensions in |x| were
   // properly handled and we pass the ones that were found to the caller.
   if (!ctx->verify_custom_crit_oids(ctx, x, found_exts)) {
+    sk_ASN1_OBJECT_pop_free(found_exts, ASN1_OBJECT_free);
     return 0;
   }
 
   // Remove the |EXFLAG_CRITICAL| flag from |x|, now that all unknown
   // critical extensions have been handled.
   x->ex_flags &= ~EXFLAG_CRITICAL;
 
+  sk_ASN1_OBJECT_pop_free(found_exts, ASN1_OBJECT_free);
   return 1;
 }