https://github.com/krb5/krb5/commit/f249555301940c6df3a2cdda13b56b5674eebc2e

--- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c	2009-12-31 04:07:03.000000000 +0000
+++ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c.oden	2013-04-29 14:08:50.000000000 +0000
@@ -2863,7 +2863,7 @@ pkinit_check_kdc_pkid(krb5_context conte
     pkiDebug("found kdcPkId in AS REQ\n");
     is = d2i_PKCS7_ISSUER_AND_SERIAL(NULL, &p, (int)pkid_len);
     if (is == NULL)
-        goto cleanup;
+        return retval;
 
     status = X509_NAME_cmp(X509_get_issuer_name(kdc_cert), is->issuer);
     if (!status) {
@@ -2873,7 +2873,6 @@ pkinit_check_kdc_pkid(krb5_context conte
     }
 
     retval = 0;
-cleanup:
     X509_NAME_free(is->issuer);
     ASN1_INTEGER_free(is->serial);
     free(is);