Missing Release of Memory after Effective Lifetime

Summary

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in "github.com/golang-fips/openssl/openssl/rsa.go#L113". The objects leaked are "pkey" and "ctx". That function uses named return parameters to free "pkey " and "ctx" if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that "pkey" and "ctx" will be nil inside the deferred function that should free them. This issue affects the packages github.com/golang-fips/openssl/v2 and github.com/golang-fips/openssl prior to 2.0.1, github.com/microsoft/go-crypto-openssl versions prior to 0.2.9.