If the "name" argument to "_hashlib.new()" is not a string, the reference count for the "string" argument is not decremented.

In the file "Modules/_hashopenssl.c", function "EVP_new()", a call to "PyBuffer_Release()" is missing:

  if (!PyArg_Parse(name_obj, "s", &name)) {
+     PyBuffer_Release(&view);
      PyErr_SetString(PyExc_TypeError, "name must be a string");
      return NULL;
  }

The change is against the 2.7 branch. The 3.2 branch is not affected.

Could you possibly provide a testcase?.

Here is a test, which fails when I run regrtest with leak detection:
    ./python -m test.regrtest -R:: test_hashlib

Looks good to me.

New changeset 49dee01d72f9 by Amaury Forgeot d'Arc in branch '2.7':
Issue #15219: Fix a reference leak when hashlib.new() is called with
http://hg.python.org/cpython/rev/49dee01d72f9

New changeset c974c99acdf5 by Amaury Forgeot d'Arc in branch 'default':
Port tests from Issue #15219, and verify we don't have a reference leak.
http://hg.python.org/cpython/rev/c974c99acdf5

Fixed in 2.7, and ported test to 3.3.
Thanks for the report and the fix!