commit 8b5cd6a682f0f6e7b8bf55137137c567d1899c4a
Author: Alexandr Nedvedicky <sashan@openssl.org>
Date:   Tue Mar 3 13:23:46 2026 +0100

    dane_match_cert() should X509_free() on ->mcert instead
    of OPENSSL_free()
    
    Fixes: 170b735820ac "DANE support for X509_verify_cert()"
    
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    MergeDate: Thu Mar  5 12:37:17 2026
    (Merged from https://github.com/openssl/openssl/pull/30250)

Index: openssl-1.1.1d/crypto/x509/x509_vfy.c
===================================================================
--- openssl-1.1.1d.orig/crypto/x509/x509_vfy.c
+++ openssl-1.1.1d/crypto/x509/x509_vfy.c
@@ -2695,7 +2695,7 @@ static int dane_match(X509_STORE_CTX *ct
             if (matched || dane->mdpth < 0) {
                 dane->mdpth = depth;
                 dane->mtlsa = t;
-                OPENSSL_free(dane->mcert);
+                X509_free(dane->mcert);
                 dane->mcert = cert;
                 X509_up_ref(cert);
             }