quic: fix BIO ownership in test helper

SSL_set_bio() transfers ownership of cbio to the client SSL object.
Clear the local pointer after the handoff so the error path does not
release an SSL-owned reference before SSL_free().

Fixes #32084

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jul 29 09:55:13 2026
(Merged from https://github.com/openssl/openssl/pull/32086)

diff --git a/test/helpers/quictestlib.c b/test/helpers/quictestlib.c
index 5405df6ebf3edf0830739b20f2a1cd34288b63ab..29508dcfd6e097e23c1f500f06b1beff2ad6741a 100644 (file)
--- a/test/helpers/quictestlib.c
+++ b/test/helpers/quictestlib.c
@@ -311,6 +311,8 @@ int qtest_create_quic_objects(OSSL_LIB_CTX *libctx, SSL_CTX *clientctx,
     }
 
     SSL_set_bio(*cssl, cbio, cbio);
+    /* Ownership of cbio is now held by *cssl */
+    cbio = NULL;
 
     if (!TEST_true(SSL_set_blocking_mode(*cssl,
             (flags & QTEST_FLAG_BLOCK) != 0 ? 1 : 0)))