Commit 84ad0cc3fe for openssl.org

commit 84ad0cc3fef8af6724b80803092cfa58acc168cc
Author: Andrew Dinh <andrewd@openssl.org>
Date:   Sun Aug 23 11:46:36 2026 +0700

    Fix tick race in radix fault-injection scripts

    Guard any `OP_SET_INJECT_WORD`+`OP_WRITE` with 2 new functions `OP_ENGINE_TICK_ENABLE`/`OP_ENGINE_TICK_DISABLE` that enable/disable ticking in the QUIC engine. Otherwise, the radix test interpreter can tick between the 2 ops and cause the peer to close the connection prematurely

    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Merge-date: Tue Sep 15 08:53:14 2026
    Merged-from: https://github.com/openssl/openssl/pull/32469

diff --git a/test/radix/quic_tests.c b/test/radix/quic_tests.c
index bf03a08929..8ecf6299b0 100644
--- a/test/radix/quic_tests.c
+++ b/test/radix/quic_tests.c
@@ -3101,9 +3101,10 @@ DEF_SCRIPT(script_50, "Fault injection - ACK - duplicate PN")
     OP_READ_EXPECT(Sa, "apple", 5);

     for (i = 0; i < 2; ++i) {
+        OP_ENGINE_TICK_DISABLE(S);
         OP_SET_INJECT_WORD(5, 0);
-
         OP_WRITE(Sa, "Strawberry", 10);
+        OP_ENGINE_TICK_ENABLE(S);
         OP_READ_EXPECT(C, "Strawberry", 10);
     }
 }
@@ -3118,9 +3119,10 @@ DEF_SCRIPT(script_51, "Fault injection - PATH_RESPONSE is ignored")
     OP_ACCEPT_STREAM_WAIT(S, Sa, 0);
     OP_READ_EXPECT(Sa, "apple", 5);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, OSSL_QUIC_FRAME_TYPE_PATH_RESPONSE);
-
     OP_WRITE(Sa, "orange", 6);
+    OP_ENGINE_TICK_ENABLE(S);
     OP_READ_EXPECT(C, "orange", 6);

     OP_WRITE(C, "Strawberry", 10);
@@ -3153,13 +3155,9 @@ static int script_52_inject_plain(RADIX_FAULT *fault, QUIC_PKT_HDR *hdr,
         if (!TEST_true(WPACKET_quic_write_vlint(&wpkt, C_BIDI_ID(0))))
             goto err;

-    if (!TEST_true(WPACKET_quic_write_vlint(&wpkt, 0xFFFFFF)))
-        goto err;
-
-    if (!TEST_true(WPACKET_get_total_written(&wpkt, &written)))
-        goto err;
-
-    if (!radix_fault_prepend_frame(fault, frame_buf, written))
+    if (!TEST_true(WPACKET_quic_write_vlint(&wpkt, 0xFFFFFF))
+        || !TEST_true(WPACKET_get_total_written(&wpkt, &written))
+        || !radix_fault_prepend_frame(fault, frame_buf, written))
         goto err;

     ok = 1;
@@ -3182,33 +3180,37 @@ DEF_SCRIPT(script_52, "Fault injection - ignore BLOCKED frames with bogus values
     OP_ACCEPT_STREAM_WAIT(S, Sa, 0);
     OP_READ_EXPECT(Sa, "apple", 5);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, OSSL_QUIC_FRAME_TYPE_DATA_BLOCKED);
-
     OP_WRITE(Sa, "orange", 6);
+    OP_ENGINE_TICK_ENABLE(S);
     OP_READ_EXPECT(C, "orange", 6);

     OP_WRITE(C, "Strawberry", 10);
     OP_READ_EXPECT(Sa, "Strawberry", 10);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, OSSL_QUIC_FRAME_TYPE_STREAM_DATA_BLOCKED);
-
     OP_WRITE(Sa, "orange", 6);
+    OP_ENGINE_TICK_ENABLE(S);
     OP_READ_EXPECT(C, "orange", 6);

     OP_WRITE(C, "Strawberry", 10);
     OP_READ_EXPECT(Sa, "Strawberry", 10);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, OSSL_QUIC_FRAME_TYPE_STREAMS_BLOCKED_UNI);
-
     OP_WRITE(Sa, "orange", 6);
+    OP_ENGINE_TICK_ENABLE(S);
     OP_READ_EXPECT(C, "orange", 6);

     OP_WRITE(C, "Strawberry", 10);
     OP_READ_EXPECT(Sa, "Strawberry", 10);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, OSSL_QUIC_FRAME_TYPE_STREAMS_BLOCKED_BIDI);
-
     OP_WRITE(Sa, "orange", 6);
+    OP_ENGINE_TICK_ENABLE(S);
     OP_READ_EXPECT(C, "orange", 6);

     OP_WRITE(C, "Strawberry", 10);
@@ -3248,10 +3250,8 @@ static int script_53_inject_plain(RADIX_FAULT *fault, QUIC_PKT_HDR *hdr,
     if (!TEST_ptr(frame_buf = OPENSSL_malloc(frame_len)))
         return 0;

-    if (!TEST_true(WPACKET_init_static_len(&wpkt, frame_buf, frame_len, 0)))
-        goto err;
-
-    if (!TEST_true(WPACKET_quic_write_vlint(&wpkt, OSSL_QUIC_FRAME_TYPE_CRYPTO))
+    if (!TEST_true(WPACKET_init_static_len(&wpkt, frame_buf, frame_len, 0))
+        || !TEST_true(WPACKET_quic_write_vlint(&wpkt, OSSL_QUIC_FRAME_TYPE_CRYPTO))
         || !TEST_true(WPACKET_quic_write_vlint(&wpkt, offset))
         || !TEST_true(WPACKET_quic_write_vlint(&wpkt, data_len)))
         goto err;
@@ -3260,10 +3260,8 @@ static int script_53_inject_plain(RADIX_FAULT *fault, QUIC_PKT_HDR *hdr,
         if (!TEST_true(WPACKET_put_bytes_u8(&wpkt, 0x42)))
             goto err;

-    if (!TEST_true(WPACKET_get_total_written(&wpkt, &written)))
-        goto err;
-
-    if (!radix_fault_prepend_frame(fault, frame_buf, written))
+    if (!TEST_true(WPACKET_get_total_written(&wpkt, &written))
+        || !radix_fault_prepend_frame(fault, frame_buf, written))
         goto err;

     ok = 1;
@@ -3287,8 +3285,10 @@ DEF_SCRIPT(script_53, "Fault injection - excess CRYPTO buffer size")
     OP_ACCEPT_STREAM_WAIT(S, Sa, 0);
     OP_READ_EXPECT(Sa, "apple", 5);

+    OP_ENGINE_TICK_DISABLE(S);
     OP_SET_INJECT_WORD(1, 0);
     OP_WRITE(Sa, "Strawberry", 10);
+    OP_ENGINE_TICK_ENABLE(S);

     OP_EXPECT_CONN_CLOSE_INFO(C, OSSL_QUIC_ERR_CRYPTO_BUFFER_EXCEEDED, 0, 0);
 }