In crypto/x509v3/v3_alt.c, around line 603: - if (!ret) + if (!ret) { X509_NAME_free(nm); + nm = NULL; + } Kurt points out: This looks like a bugfix that needs to go to other branches. We probably shouldn't even touch gen in case of an error. / .