Fix from review

Author: embhorn

tests/api/test_x509.c

@@ -1127,7 +1127,7 @@ int test_x509_ReqCertFromX509_skid_max(void)
     defined(WOLFSSL_CERT_REQ) && !defined(NO_BIO) && defined(HAVE_ECC) && \
     defined(USE_CERT_BUFFERS_256) && \
     (defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL))
-    X509* req = NULL;
+    X509_REQ* req = NULL;
     X509_NAME* name = NULL;
     EVP_PKEY* priv = NULL;
     BIO* bio = NULL;
@@ -1137,6 +1137,7 @@ int test_x509_ReqCertFromX509_skid_max(void)
     STACK_OF(X509_EXTENSION)* exts = NULL;
     const unsigned char* keyPtr = ecc_clikey_der_256;
     unsigned char skid_bytes[CTC_MAX_SKID_SIZE];
+    int pushed = 0;
     int i;
 
     for (i = 0; i < CTC_MAX_SKID_SIZE; i++) {
@@ -1160,9 +1161,14 @@ int test_x509_ReqCertFromX509_skid_max(void)
     ExpectNotNull(skid_ext = X509_EXTENSION_create_by_OBJ(NULL, skid_oid, 0,
         skid_data));
     ExpectNotNull(exts = sk_X509_EXTENSION_new_null());
-    ExpectIntEQ(sk_X509_EXTENSION_push(exts, skid_ext), 1);
-    if (EXPECT_FAIL()) {
-        X509_EXTENSION_free(skid_ext);
+    /* Snapshot the push result so cleanup is decided by *this* call rather
+     * than by any earlier expectation failure that may have set EXPECT_FAIL. */
+    if (skid_ext != NULL && exts != NULL) {
+        pushed = sk_X509_EXTENSION_push(exts, skid_ext);
+    }
+    ExpectIntEQ(pushed, 1);
+    if (pushed == 1) {
+        skid_ext = NULL; /* ownership transferred to exts */
     }
     ExpectIntEQ(X509_REQ_add_extensions(req, exts), 1);
 
@@ -1175,6 +1181,9 @@ int test_x509_ReqCertFromX509_skid_max(void)
 
     BIO_free(bio);
     sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+    /* Free skid_ext only if it was never successfully pushed (ownership
+     * remained with us); otherwise pop_free() above already freed it. */
+    X509_EXTENSION_free(skid_ext);
     ASN1_OCTET_STRING_free(skid_data);
     ASN1_OBJECT_free(skid_oid);
     EVP_PKEY_free(priv);