Only get PKCS11_OBJECT references for private keys

Author: mtrojnar

src/p11_key.c

@@ -481,7 +481,8 @@ EVP_PKEY *pkcs11_get_key(PKCS11_OBJECT_private *key0, CK_OBJECT_CLASS object_cla
 			EVP_PKEY_free(ret);
 			goto err;
 		}
-		pkcs11_object_ref(key);
+		if (key->object_class == CKO_PRIVATE_KEY)
+			pkcs11_object_ref(key);
 		break;
 	case EVP_PKEY_EC:
 #if OPENSSL_VERSION_NUMBER < 0x30000000L || defined(LIBRESSL_VERSION_NUMBER)
@@ -498,7 +499,8 @@ EVP_PKEY *pkcs11_get_key(PKCS11_OBJECT_private *key0, CK_OBJECT_CLASS object_cla
 			EVP_PKEY_free(ret);
 			goto err;
 		}
-		pkcs11_object_ref(key);
+		if (key->object_class == CKO_PRIVATE_KEY)
+			pkcs11_object_ref(key);
 #else
 		ret = EVP_PKEY_dup(key->evp_key);
 #endif