[openssl/openssl] bb2a63: quic: free popped incoming channel on early exit i...

[Joshua Rogers]

Branch: refs/heads/openssl-3.6
Home: https://github.com/openssl/openssl
Commit: bb2a631a768229edc0b80d2d0094ab55295a5831
https://github.com/openssl/openssl/commit/bb2a631a768229edc0b80d2d0094ab55295a5831
Author: Joshua Rogers <MegaM...@users.noreply.github.com>
Date: 2026-01-12 (Mon, 12 Jan 2026)

Changed paths:
M ssl/quic/quic_impl.c

Log Message:
-----------
quic: free popped incoming channel on early exit in accept_connection

If we pop a channel but fail to extract or adopt its SSL pointer,
we return without releasing the channel. Add a small cleanup at
the function epilogue to free new_ch when conn_ssl is NULL.

Signed-off-by: Joshua Rogers <MegaM...@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sas...@openssl.org>
Reviewed-by: Tim Hudson <t...@openssl.org>
Reviewed-by: Tomas Mraz <to...@openssl.org>
MergeDate: Mon Jan 12 18:54:05 2026
(Merged from https://github.com/openssl/openssl/pull/28920)

(cherry picked from commit d62febf758fafdfa90a599df2028cbe1b5d52f2a)


Commit: d193424efab3f6d629bb3d35968d9b937dfcb0cb
https://github.com/openssl/openssl/commit/d193424efab3f6d629bb3d35968d9b937dfcb0cb
Author: Joshua Rogers <MegaM...@users.noreply.github.com>
Date: 2026-01-12 (Mon, 12 Jan 2026)

Changed paths:
M ssl/quic/quic_impl.c

Log Message:
-----------
quic: remove redundant free of inner TLS in accept_connection

SSL_free(conn_ssl) for a QCSO enters ossl_quic_free, which calls qc_cleanup.
qc_cleanup already frees qc->tls via SSL_free(qc->tls) and then frees qc->ch.
The additional SSL_free(ossl_quic_channel_get0_tls(new_ch)) releases the same
TLS a second time, which is redundant.

We also replace some of the pure condition checks with ossl_assert() checks
as these conditions cannot really fail.

Signed-off-by: Joshua Rogers <MegaM...@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sas...@openssl.org>
Reviewed-by: Tim Hudson <t...@openssl.org>
Reviewed-by: Tomas Mraz <to...@openssl.org>
MergeDate: Mon Jan 12 18:54:07 2026
(Merged from https://github.com/openssl/openssl/pull/28920)

(cherry picked from commit 92b5ba86f68b200c0f2549ec21a5edaaf2da4735)


Commit: e96fe3eeb52be43925302b4fe2a49762b5098b75
https://github.com/openssl/openssl/commit/e96fe3eeb52be43925302b4fe2a49762b5098b75
Author: Joshua Rogers <MegaM...@users.noreply.github.com>
Date: 2026-01-12 (Mon, 12 Jan 2026)

Changed paths:
M ssl/quic/quic_channel.c

Log Message:
-----------
quic: remove dead VERSION_NEG handling in ch_rx_handle_packet

VERSION_NEG packets are handled and returned from earlier in the function.
The later switch case and its helper are unreachable and contradictory.
Remove them to avoid confusion and future behavior drift.

Signed-off-by: Joshua Rogers <MegaM...@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sas...@openssl.org>
Reviewed-by: Tim Hudson <t...@openssl.org>
Reviewed-by: Tomas Mraz <to...@openssl.org>
MergeDate: Mon Jan 12 18:54:09 2026
(Merged from https://github.com/openssl/openssl/pull/28920)

(cherry picked from commit 0f20676e992f00b0335e2008f504afaa00bb8e40)


Compare: https://github.com/openssl/openssl/compare/c3d0df0dc02a...e96fe3eeb52b

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications