Commit b03d2d23c2 for openssl.org

commit b03d2d23c23edcb919410c00c3c4edc3124bc9c8
Author: Matt Caswell <matt@openssl.foundation>
Date:   Mon Oct 19 09:37:48 2026 +0100

    Clear the next pointer when inserting into an empty pqueue

    pqueue_pop() leaves the popped item's next pointer intact. If that item
    is then inserted into an empty queue, pqueue_insert() kept the stale
    pointer, which links back into the queue it came from.
    dtls1_clear_sent_buffer() does exactly this with its temporary queue. If
    it then frees the item that the stale pointer refers to, the freed item
    is reached again when the temporary queue is drained.

    DTLS 1.3 has not been in any final release, so no released version of
    OpenSSL is affected.

    Discovered by Anthropic's OSS Scanner (finding ANT-2026-YZ5U4MXB).

    Assisted-by: Claude Code:claude-opus-5-5
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
    Merge-date: Tue Oct 20 12:38:20 2026
    Merged-from: https://github.com/openssl/openssl/pull/33256

diff --git a/ssl/pqueue.c b/ssl/pqueue.c
index d984de01ab..e413d8c5ae 100644
--- a/ssl/pqueue.c
+++ b/ssl/pqueue.c
@@ -62,6 +62,7 @@ pitem *pqueue_insert(pqueue *pq, pitem *item)
     pitem *curr, *next;

     if (pq->items == NULL) {
+        item->next = NULL;
         pq->items = item;
         return item;
     }