Commit 4bfa36be77 for openssl.org

commit 4bfa36be77cd5f804d53801a21f027a741b9b097
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date:   Thu Oct 15 08:07:16 2026 +0200

    test: clear stale RADIX handshake injection selectors

    The handshake injection helpers share radix_fault with earlier scripts
    but left its selector words unchanged. script_68 leaves word0 set to 1,
    which selects CertificateRequest. script_69 installs the same callback
    before it sets word0 to 2 for KeyUpdate. A session ticket generated in
    that interval can trigger the previous script's fault and close the
    connection before the intended KeyUpdate injection.

    Clear both selector words in the handshake injection setup paths, as
    the plaintext injection setup already does. Request a normal session
    ticket in script_69 before arming its fault, so the test exercises the
    interval where an inherited selector caused the unexpected close.
    Keep the expected KeyUpdate close code unchanged.

    Assisted-by: Codex:gpt-6-astra
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Fri Oct 23 12:40:35 2026
    Merged-from: https://github.com/openssl/openssl/pull/33213

diff --git a/test/radix/quic_ops.c b/test/radix/quic_ops.c
index 4ed639830a..347441cf74 100644
--- a/test/radix/quic_ops.c
+++ b/test/radix/quic_ops.c
@@ -1689,6 +1689,8 @@ DEF_FUNC(hf_set_inject_handshake_cb)
     OPENSSL_free(radix_fault.handbuf);
     radix_fault.handbuf = NULL;
     radix_fault.handbuflen = 0;
+    radix_fault.word0 = 0;
+    radix_fault.word1 = 0;
     radix_fault.hcb = radix_fault_ptr_to_handshake_cb(cbptr);

     ok = 1;
@@ -1709,6 +1711,8 @@ DEF_FUNC(hf_set_inject_handshake)
     radix_fault.handbuf = NULL;
     radix_fault.handbuflen = 0;
     radix_fault.handbufalloc = 0;
+    radix_fault.word0 = 0;
+    radix_fault.word1 = 0;
     radix_fault.hcb = radix_fault_ptr_to_handshake_cb(cbptr);

     if (!TEST_true(ossl_statem_set_mutator(ssl, radix_fault_handshake_mutate,
diff --git a/test/radix/quic_tests.c b/test/radix/quic_tests.c
index e0b673a1df..e2ce340776 100644
--- a/test/radix/quic_tests.c
+++ b/test/radix/quic_tests.c
@@ -4507,6 +4507,9 @@ DEF_SCRIPT(script_69, "Send a TLS KeyUpdate message post-handshake")
     OP_ACCEPT_STREAM_WAIT(S, Sa, 0);
     OP_READ_EXPECT(Sa, "apple", 5);

+    /* A normal ticket must not reuse the previous script's injection. */
+    OP_NEW_TICKET(S);
+
     OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(2, 0);
     OP_NEW_TICKET(S);