Commit 4242c885ba for openssl.org

commit 4242c885ba80e9fd0a652d7f07be248afaa7f7f9
Author: Neil Horman <nhorman@openssl.org>
Date:   Tue Sep 22 12:04:35 2026 -0400

    Restore QUIC token value after second urxe decode

    When decoding a datagram in qrx_process_pkt, we reserve some space in
    the rxe and copy the token out of the packet to the rxe header.
    However, if we do a second decode in this function (which is possible),
    we reset that pointer to point into the datagram buffer.  While this is
    generally not catastrophic as there is no non-debug code that references
    this pointer after the URXE is freed, its an issue waiting to happen, so
    if we do a second decode, restore the token pointer again to point to
    our reserved space.

    Fixes openssl/srt#298

    Reviewed-by: Saša Nedvědický <sashan@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Fri Sep 25 10:58:42 2026
    Merged-from: https://github.com/openssl/openssl/pull/32933

diff --git a/ssl/quic/quic_record_rx.c b/ssl/quic/quic_record_rx.c
index 0b4d18e97b..e69d19207e 100644
--- a/ssl/quic/quic_record_rx.c
+++ b/ssl/quic/quic_record_rx.c
@@ -994,6 +994,7 @@ static int qrx_process_pkt(OSSL_QRX *qrx, QUIC_URXE *urxe,
     uint32_t pn_space, enc_level;
     OSSL_QRL_ENC_LEVEL *el = NULL;
     uint64_t rx_key_epoch = UINT64_MAX;
+    const unsigned char *token = NULL;

     /*
      * Get a free RXE. If we need to allocate a new one, use the packet length
@@ -1127,7 +1128,7 @@ static int qrx_process_pkt(OSSL_QRX *qrx, QUIC_URXE *urxe,
      * Relocate token buffer and fix pointer.
      */
     if (rxe->hdr.type == QUIC_PKT_TYPE_INITIAL) {
-        const unsigned char *token = rxe->hdr.token;
+        token = rxe->hdr.token;

         /*
          * This may change the value of rxe and change the value of the token
@@ -1161,6 +1162,12 @@ static int qrx_process_pkt(OSSL_QRX *qrx, QUIC_URXE *urxe,
                 0, 0, &rxe->hdr, NULL, NULL)
             != 1)
             goto malformed;
+        /*
+         * Restore the relocated token value here, since the above decode reset it
+         * to be within the packet
+         */
+        if (token != NULL)
+            rxe->hdr.token = token;
     }

     /* Validate header and decode PN. */