diff --git a/backport-Pipeline-output-input-buf-arrays-must-live-until-the.patch b/backport-Pipeline-output-input-buf-arrays-must-live-until-the.patch
new file mode 100644
index 0000000000000000000000000000000000000000..66e2409ab8bfbea36528f4facbc94639f1e95f0c
--- /dev/null
+++ b/backport-Pipeline-output-input-buf-arrays-must-live-until-the.patch
@@ -0,0 +1,45 @@
+From df9c7ceefef59cc870c80346906471fabec62494 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt@openssl.org>
+Date: Fri, 21 Oct 2022 14:08:29 +0100
+Subject: [PATCH] Pipeline output/input buf arrays must live until the
+ EVP_Cipher is called
+
+Conflict:adapt context
+Reference:https://github.com/openssl/openssl/commit/df9c7ceefef59cc870c80346906471fabec62494
+
+The pipeline input/output buf arrays must remain accessible to the
+EVP_CIPHER_CTX until EVP_Cipher is subsequently called. This fixes an
+asan error discovered by the newly added pipeline test.
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Hugo Landau <hlandau@openssl.org>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/20208)
+---
+ ssl/record/ssl3_record.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/ssl/record/ssl3_record.c b/ssl/record/ssl3_record.c
+index 368aaea5e9..4256f29663 100644
+--- a/ssl/record/ssl3_record.c
++++ b/ssl/record/ssl3_record.c
+@@ -964,6 +964,7 @@ int tls1_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int sending,
+     EVP_CIPHER_CTX *ds;
+     size_t reclen[SSL_MAX_PIPELINES];
+     unsigned char buf[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN];
++    unsigned char *data[SSL_MAX_PIPELINES];
+     int i, pad = 0, ret, tmpr;
+     size_t bs, mac_size = 0, ctr, padnum, loop;
+     unsigned char padval;
+@@ -1123,8 +1124,6 @@ int tls1_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int sending,
+             }
+         }
+         if (n_recs > 1) {
+-            unsigned char *data[SSL_MAX_PIPELINES];
+-
+             /* Set the output buffers */
+             for (ctr = 0; ctr < n_recs; ctr++) {
+                 data[ctr] = recs[ctr].data;
+-- 
+2.33.0
+
diff --git a/openssl.spec b/openssl.spec
index ce61ac477d216f699f2a6a5439e9477badd6900c..aeb8f7dbb9db9a08193f89170c46e997158d1df9 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -2,7 +2,7 @@
 Name:        openssl
 Epoch:       1
 Version:     1.1.1f
-Release:     35
+Release:     36
 Summary:     Cryptography and SSL/TLS Toolkit
 License:     OpenSSL and SSLeay and GPLv2+
 URL:         https://www.openssl.org/
@@ -143,6 +143,7 @@ Patch132:    backport-CVE-2024-4741-Only-free-the-read-buffer.patch
 Patch133:    backport-CVE-2024-4741-Set-rlayer.packet-to-NULL-after-we-ve-.patch
 Patch134:    backport-CVE-2024-4741-test-Fix-possible-use-after-free.patch
 Patch135:    backport-CVE-2024-5535-Fix-SSL_select_next_proto-and-add-ALPN.patch
+Patch136:    backport-Pipeline-output-input-buf-arrays-must-live-until-the.patch
 
 BuildRequires: gcc make lksctp-tools-devel coreutils util-linux zlib-devel
 
@@ -326,6 +327,9 @@ make test || :
 %{_pkgdocdir}/html/
 
 %changelog
+* Fri Oct 11 2024 hugel <gengqihu2@h-partners.com> - 1:1.1.1f-36
+- fix openssl asan error
+
 * Thu Jul 4 2024 steven <steven_ygui@163.com> - 1:1.1.1f-35
 - fix CVE-2024-5535