EVP_PKEY_verify() heap leak during signature verification failure

Memory Exhaustion in EVP API

When utilizing the OpenSSL EVP API for signature verification, the EVP_PKEY_verify() function can result in memory exhaustion under specific failure conditions. While CVE-2022-0778 addressed certain instances of NULL pointer handling, the deallocation logic for nested ASN.1 structures during early exit paths remains complex.

The issue is prevalent when internal structures are allocated but not properly freed via manual reference counting. If the verification process terminates prematurely due to a malformed signature or incompatible key type, the logic may bypass necessary EVP_PKEY_free() calls. Because OpenSSL utilizes a custom allocator (OPENSSL_malloc), standard system profiling tools often fail to detect these leaks without specific intercept configurations.

What are the specific exit paths in the EVP 3.x provider architecture where nested ASN.1 structures fail to be deallocated? Is there a recommended pattern for ensuring that manual reference counts are correctly cleared when a verification returns an error code?