Commit edf18df464 for openssl.org

commit edf18df464a875be80ead59ddd0a4d7ec077e4a8
Author: Nikola Pajkovsky <nikolap@openssl.org>
Date:   Wed Sep 16 07:58:18 2026 +0200

    QUIC: initialize Retry WPACKET before error-path cleanup

    port_send_retry() can jump to err before WPACKET_init_static_len()
    is called. The unconditional WPACKET_cleanup() then reads an
    uninitialized subs pointer, potentially causing an invalid access
    or free.

    Fixes Coverity CID 1701220.
    Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Merge-date: Mon Sep 21 09:42:55 2026
    Merged-from: https://github.com/openssl/openssl/pull/32843

diff --git a/ssl/quic/quic_port.c b/ssl/quic/quic_port.c
index bda344e96a..c8faaf8242 100644
--- a/ssl/quic/quic_port.c
+++ b/ssl/quic/quic_port.c
@@ -1266,7 +1266,7 @@ static void port_send_retry(QUIC_PORT *port,
      */
     unsigned char buffer[512];
     unsigned char ct_buf[ENCRYPTED_TOKEN_MAX_LEN];
-    WPACKET wpkt;
+    WPACKET wpkt = { 0 };
     size_t written, token_buf_len, ct_len;
     QUIC_PKT_HDR hdr = { 0 };
     QUIC_VALIDATION_TOKEN token = { 0 };