[openssl/openssl] 06bfa7: quic: fix handling of the first rxe mfail in qrx_p...

  Branch: refs/heads/openssl-3.5
  Home:   https://github.com/openssl/openssl
  Commit: 06bfa759603a0017597db4a34cf11fb0f745af38
      https://github.com/openssl/openssl/commit/06bfa759603a0017597db4a34cf11fb0f745af38
  Author: Jakub Zelenka <[email protected]>
  Date:   2026-05-29 (Fri, 29 May 2026)

  Changed paths:
    M ssl/quic/quic_record_rx.c

  Log Message:
  -----------
  quic: fix handling of the first rxe mfail in qrx_process_pkt

When qrx_ensure_free_rxe() fails at the start of qrx_process_pkt() the
function returned 0 without advancing the PACKET cursor and, for the
first packet in the datagram, without setting first_dcid. The
qrx_process_datagram() loop then re-entered qrx_process_pkt() for the
same bytes with pkt_idx >= 1 and the sentinel first_dcid (id_len = 255),
tripping the assertion in qrx_validate_hdr_early() that asserts
first_dcid->id_len to be lower than QUIC_MAX_CONN_ID_LEN.

The fix goes to malformed label instead. The header has not been decoded
at this point so eop is NULL, which makes the malformed path discard the
rest of the datagram. This is because without an RXE we can process
neither this packet nor any that follow it. This also advances the
cursor and, when the failure is on the first packet, avoids leaving
first_dcid unset for the next iteration. It is consistent with the
other allocation-failure site in the function, which already routes
through malformed.

Reviewed-by: Matt Caswell <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
MergeDate: Fri May 29 14:08:56 2026
(Merged from https://github.com/openssl/openssl/pull/31316)

(cherry picked from commit 31d61a1ceb1556d729410d4ae59503f49e58cf22)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.5/5969ea-06bfa7%40github.com.