Commit 8a7d94bd83 for openssl.org

commit 8a7d94bd83570fedac86d80e0dc37b09990a6a4b
Author: Nicky Mouha <nicky@mouha.be>
Date:   Wed Oct 28 11:36:16 2026 -0400

    providers/implementations/kem/ml_kem_kem.c: do FIPS self-test before context allocation

    Do the FIPS self-test before context allocation in ml_kem_newctx()
    to avoid leaking the allocated context in case of self-check failure,
    replace OPENSSL_malloc() with OPENSSL_zalloc() to avoid leaving
    entropy_buf[] uninitialized, and add a missing ossl_prov_is_running()
    check.

    Fixes: 40240719507c "Switch FIPS self tests to deferred execution"
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Merge-date: Tue Nov 10 15:47:25 2026
    Merged-from: https://github.com/openssl/openssl/pull/33437

diff --git a/providers/implementations/kem/ml_kem_kem.c b/providers/implementations/kem/ml_kem_kem.c
index 2d38e8c805..e6e4bcd672 100644
--- a/providers/implementations/kem/ml_kem_kem.c
+++ b/providers/implementations/kem/ml_kem_kem.c
@@ -49,7 +49,7 @@ static void *ml_kem_newctx(void *provctx)
 {
     PROV_ML_KEM_CTX *ctx;

-    if ((ctx = OPENSSL_malloc(sizeof(*ctx))) == NULL)
+    if (!ossl_prov_is_running())
         return NULL;

 #ifdef FIPS_MODULE
@@ -58,11 +58,7 @@ static void *ml_kem_newctx(void *provctx)
         return NULL;
 #endif

-    ctx->key = NULL;
-    ctx->entropy = NULL;
-    ctx->op = 0;
-    ctx->test_entropy_used = 0;
-    return ctx;
+    return OPENSSL_zalloc(sizeof(*ctx));
 }

 static void ml_kem_freectx(void *vctx)