From 59ad7a7c09e1aa31b782bf9f584768b4fd1cd04b Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Tue, 1 Sep 2026 09:52:01 +0200 Subject: [PATCH] MINOR: quic: protect the ChaCha20 header protection context from being freed quic_tls_secrets_keys_free() calls EVP_CIPHER_CTX_free() on without checking it against EVP_CIPHER_CTX_CHACHA20. With AWS-LC this member may hold this value, which points to a static object and not to an allocated context. quic_tls_ctx_secs_free() already guards against it. This cannot happen today, as the only caller runs before the contexts are created. Add the same guard, and reset and so that calling this function twice is harmless. Should be backported as far as 2.6 to ease any future bug fix backport. --- include/haproxy/quic_tls.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/haproxy/quic_tls.h b/include/haproxy/quic_tls.h index 0ee2eb40e..dac45a3f2 100644 --- a/include/haproxy/quic_tls.h +++ b/include/haproxy/quic_tls.h @@ -868,9 +868,16 @@ static inline void quic_tls_secrets_keys_free(struct quic_tls_secrets *secs) } /* HP protection */ +#ifdef QUIC_AEAD_API + if (secs->hp_ctx != EVP_CIPHER_CTX_CHACHA20) + EVP_CIPHER_CTX_free(secs->hp_ctx); +#else EVP_CIPHER_CTX_free(secs->hp_ctx); +#endif + secs->hp_ctx = NULL; /* AEAD decryption */ QUIC_AEAD_CTX_free(secs->ctx); + secs->ctx = NULL; pool_free(pool_head_quic_tls_iv, secs->iv); pool_free(pool_head_quic_tls_key, secs->key); -- 2.47.3