tb@ spotted this one. If BIO_new fails we leak scon, so SSL_free it in that case.
ok? -- Scott Cheloha Index: usr.bin/openssl/s_time.c =================================================================== RCS file: /cvs/src/usr.bin/openssl/s_time.c,v retrieving revision 1.25 diff -u -p -r1.25 s_time.c --- usr.bin/openssl/s_time.c 11 Aug 2018 16:07:36 -0000 1.25 +++ usr.bin/openssl/s_time.c 13 Aug 2018 15:53:12 -0000 @@ -365,8 +346,10 @@ doConnection(SSL * scon) long verify_error; int i; - if ((conn = BIO_new(BIO_s_connect())) == NULL) + if ((conn = BIO_new(BIO_s_connect())) == NULL) { + SSL_free(scon); return (NULL); + } /* BIO_set_conn_port(conn,port);*/ BIO_set_conn_hostname(conn, s_time_config.host);