Double free or use-after-free following ossl_quic_tls_free in ssl3_free

Hello,

It seems that in certain conditions, calling SSL_clear will corrupt a SSL object used for QUIC (with an external transport) when using OpenSSL 3.5.3. More specifically, we complete an handshake, then want to re-use the SSL object, so we call SSL_shutdown and SSL_clear. Within ossl_ssl_connection_reset, s->method->ssl_deinit(s); is invoked so ssl3_free ends up calling ossl_quic_tls_free(sc->qtls);. The issue is that the qtls pointer is not set to NULL.

• It gets used after free in ossl_ssl_connection_reset as ossl_quic_tls_clear(sc->qtls); will access it.
• If you call SSL_free once you are done with it, it will double-free the qtls pointer.
• If you try to call SSL_set_quic_tls_cbs to set callbacks again, it will double-free the qtls pointer again.

Fixing ssl3_free with this code seems enough:

ossl_quic_tls_free(sc->qtls);
sc->qtls = NULL;

ossl_quic_tls_free is also used in SSL_set_quic_tls_cbs but its usage here is safe (the pointer is overwritten right after it is freed), and in ch_cleanup but I didn't track if the QUIC_CHANNEL can be re-used after this function.

On a side note, is it expected to have to call again SSL_set_quic_tls_cbs after calling SSL_clear? It seems to be reset only because the SSL object is created with TLS_(client|server)_method() and during the handshake, it gets changed to tlsv_1_3_(client|server)_method so it no longer matches and the object is re-initialized, loosing all the QUIC options.

Start at ssl3_free and follow the ossl_ssl_connection_reset path through ossl_quic_tls_free and ossl_quic_tls_clear. Reproduce reuse with SSL_shutdown followed by SSL_clear, then check SSL_free and SSL_set_quic_tls_cbs paths for double frees or use-after-free; done means the SSL object can be safely reset and released without corrupting its QUIC state.