I am not sure about this one. Factually it is of course true, however there are many other functions like this that obviously construct some new objects either in clean state or by decoding some data. I would not like to confuse users that only these PEM_read functions create objects to be owned by caller. If we documented all the similar places then OK but just changing this place looks wrong to me.

If we documented all the similar places then OK but just changing this place looks wrong to me

I'm just clarifying parts that cover my scenario, which I tested with valgrind. I haven't touched any other API. Can you give me a list of similar places?

I'm thinking that the page describing all the i2d_ and d2i_ functions would be another candidate for this sort of amendment. Curiously, though, the i2d_ function description has a passage like this:

If *ppout is NULL memory will be allocated for a buffer and the encoded
data written to it. In this case *ppout is not incremented and it points
to the start of the data just written.

So it seems that in some places, we do at least give a hint that something needs to be freed.

I'm thinking that the page describing all the i2d_ and d2i_ functions would be another candidate for this sort of amendment.

A similar note added to doc/man3/d2i_X509.pod.

Let me know what other pages you think need to be updated.

This pull request is ready to merge

Merged to all the active branches. Thank you for your contribution.