nm.a is initialized to NULL until it gets alloced by x509_name_ex_new().
The following 'goto err' should free nm.a before returning.
ok?
Index: asn1/x_name.c
===================================================================
RCS file: /cvs/src/lib/libcrypto/asn1/x_name.c,v
retrieving revision 1.37
diff -u -p -r1.37 x_name.c
--- asn1/x_name.c 25 Dec 2021 13:17:48 -0000 1.37
+++ asn1/x_name.c 8 Nov 2022 17:45:08 -0000
@@ -340,6 +340,7 @@ x509_name_ex_d2i(ASN1_VALUE **val, const
err:
if (nm.x != NULL)
X509_NAME_free(nm.x);
+ free(nm.a);
ASN1error(ERR_R_NESTED_ASN1_ERROR);
return 0;
}