Commit e4aeafa81d for openssl.org

commit e4aeafa81d19f5d0bfd12d1875ae9eac151332c4
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Wed Sep 2 15:41:32 2026 +0200

    Free WPACKETs on error paths

    Fixes coverity issue 1700560.

    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Jakub Zelenka <jakub.zelenka@openssl.foundation>
    Merge-date: Tue Sep 15 10:11:12 2026
    Merged-from: https://github.com/openssl/openssl/pull/32663

diff --git a/ssl/quic/quic_port.c b/ssl/quic/quic_port.c
index 6c8bb17a77..bda344e96a 100644
--- a/ssl/quic/quic_port.c
+++ b/ssl/quic/quic_port.c
@@ -1352,6 +1352,7 @@ static void port_send_retry(QUIC_PORT *port,
             "port retry send failed due to network BIO I/O error");

 err:
+    WPACKET_cleanup(&wpkt);
     cleanup_validation_token(&token);
 }

@@ -1418,21 +1419,21 @@ static void port_send_version_negotiation(QUIC_PORT *port, BIO_ADDR *peer,

     if (!ossl_quic_wire_encode_pkt_hdr(&wpkt, client_hdr->dst_conn_id.id_len,
             &hdr, NULL))
-        return;
+        goto err;

     /*
      * Add the array of supported versions to the end of the packet
      */
     for (i = 0; i < OSSL_NELEM(supported_versions); i++) {
         if (!WPACKET_put_bytes_u32(&wpkt, supported_versions[i]))
-            return;
+            goto err;
     }

     if (!WPACKET_get_total_written(&wpkt, &msg[0].data_len))
-        return;
+        goto err;

     if (!WPACKET_finish(&wpkt))
-        return;
+        goto err;

     /*
      * Send it back to the client attempting to connect
@@ -1442,6 +1443,10 @@ static void port_send_version_negotiation(QUIC_PORT *port, BIO_ADDR *peer,
     if (!BIO_sendmmsg(port->net_wbio, msg, sizeof(BIO_MSG), 1, 0, &written))
         ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
             "port version negotiation send failed");
+    return;
+err:
+    WPACKET_cleanup(&wpkt);
+    return;
 }

 /**
diff --git a/ssl/statem/statem_dtls.c b/ssl/statem/statem_dtls.c
index c63213c5d8..93533a49fa 100644
--- a/ssl/statem/statem_dtls.c
+++ b/ssl/statem/statem_dtls.c
@@ -184,8 +184,10 @@ static int dtls1_write_hm_header(unsigned char *msgheaderstart,
         || !WPACKET_put_bytes_u24(&msgheader, fraglen)
         || !WPACKET_get_total_written(&msgheader, &msgheaderlen)
         || msgheaderlen != DTLS1_HM_HEADER_LENGTH
-        || !WPACKET_finish(&msgheader))
+        || !WPACKET_finish(&msgheader)) {
+        WPACKET_cleanup(&msgheader);
         return 0;
+    }

     return 1;
 }
diff --git a/test/quic_multistream_test.c b/test/quic_multistream_test.c
index 2e6ae86f4d..29927336a6 100644
--- a/test/quic_multistream_test.c
+++ b/test/quic_multistream_test.c
@@ -2891,15 +2891,15 @@ static int server_gen_version_neg(struct helper *h, BIO_MSG *msg, size_t stride)
         goto err;

     if (!TEST_true(qtest_fault_resize_datagram(h->qtf, l)))
-        return 0;
+        goto err;

     memcpy(msg->data, buf->data, l);
     h->inject_word0 = 0;

     rc = 1;
 err:
-    if (have_wpkt)
-        WPACKET_finish(&wpkt);
+    if (have_wpkt && !WPACKET_finish(&wpkt))
+        WPACKET_cleanup(&wpkt);

     BUF_MEM_free(buf);
     return rc;