Commit 6d76833d61 for openssl.org

commit 6d76833d61fad07a171219d9cb1444bc37f88b8f
Author: jdymitarai <o10040115@gmail.com>
Date:   Tue Oct 13 13:46:03 2026 +0900

    test/cmp_vfy_test.c: prevent memory leak in test_msg_check_update_malicious_sender

    In test_msg_check_update_malicious_sender(), expected and actual
    were allocated via X509_NAME_new() prior to SETUP_TEST_FIXTURE().
    If set_up() failed, SETUP_TEST_FIXTURE() returned early, leaking
    both allocated X509_NAME objects.

    Defer allocation until after SETUP_TEST_FIXTURE(), initialize both
    pointers to NULL, and allocate them safely within the TEST_ptr()
    validation chain.  On setup or validation failure, both pointers
    and the test fixture are freed cleanly.

    Resolves: https://github.com/openssl/openssl/issues/33200
    Fixes: a6286cd01801 "Add test for CVE-2026-63073"
    CLA: trivial
    Signed-off-by: jdymitarai <o10040115@gmail.com>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Thu Oct 15 11:51:16 2026
    Merged-from: https://github.com/openssl/openssl/pull/33203

diff --git a/test/cmp_vfy_test.c b/test/cmp_vfy_test.c
index 5c7fc247e3..7861333237 100644
--- a/test/cmp_vfy_test.c
+++ b/test/cmp_vfy_test.c
@@ -569,17 +569,13 @@ static int execute_msg_check_update_malicious_sender(CMP_VFY_TEST_FIXTURE *fixtu
 static int test_msg_check_update_malicious_sender(void)
 {
     OSSL_CMP_PKIHEADER *hdr;
-    X509_NAME *expected = X509_NAME_new();
-    X509_NAME *actual = X509_NAME_new();
-
-    if (expected == NULL || actual == NULL) {
-        X509_NAME_free(expected);
-        X509_NAME_free(actual);
-        return 0;
-    }
+    X509_NAME *expected = NULL;
+    X509_NAME *actual = NULL;

     SETUP_TEST_FIXTURE(CMP_VFY_TEST_FIXTURE, set_up);
-    if (!TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))
+    if (!TEST_ptr(expected = X509_NAME_new())
+        || !TEST_ptr(actual = X509_NAME_new())
+        || !TEST_ptr(fixture->msg = load_pkimsg(ir_protected_f, libctx))
         || !TEST_ptr(hdr = OSSL_CMP_MSG_get0_header(fixture->msg))
         || !TEST_int_eq(X509_NAME_add_entry_by_txt(expected, "CN", MBSTRING_ASC,
                             (unsigned char *)"%n", -1, -1, 0),