From 798a16c520da264a38e0e030a16ac052b6bd6463 Mon Sep 17 00:00:00 2001
From: Tuan Phan <tuan.phan@oss.qualcomm.com>
Date: Sun, 25 Jan 2026 15:29:42 -0800
Subject: [PATCH] CryptoPkg: TlsLib: Fix uninitialized variable warnings

In TlsSetCipherList(), the OpensslCipher variable is initialized inside an
inner loop but accessed outside of that loop, which can lead to
uninitialized variable warnings.

Fix this issue by moving all accesses to OpensslCipher into the inner loop
where it is initialized.

Signed-off-by: Tuan Phan <tuan.phan@oss.qualcomm.com>
---
 CryptoPkg/Library/TlsLib/TlsConfig.c | 62 ++++++++++++++--------------
 1 file changed, 31 insertions(+), 31 deletions(-)

diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c b/CryptoPkg/Library/TlsLib/TlsConfig.c
index c21b6f70be..54cfb1a9a8 100644
--- a/CryptoPkg/Library/TlsLib/TlsConfig.c
+++ b/CryptoPkg/Library/TlsLib/TlsConfig.c
@@ -227,9 +227,38 @@ TlsSetCipherList (
     //
     for (StackIdx = 0; StackIdx < sk_SSL_CIPHER_num (OpensslCipherStack); StackIdx++) {
       OpensslCipher = sk_SSL_CIPHER_value (OpensslCipherStack, StackIdx);
-      if (CipherId[Index] == SSL_CIPHER_get_protocol_id (OpensslCipher)) {
-        break;
+      if (CipherId[Index] != SSL_CIPHER_get_protocol_id (OpensslCipher)) {
+        continue;
       }
+
+      //
+      // Accumulate cipher name string length into CipherStringSize. If this
+      // is not the first successful mapping, account for a colon (":") prefix
+      // too.
+      //
+      if (MappedCipherCount > 0) {
+        Status = SafeUintnAdd (CipherStringSize, 1, &CipherStringSize);
+        if (EFI_ERROR (Status)) {
+          Status = EFI_OUT_OF_RESOURCES;
+          goto FreeMappedCipher;
+        }
+      }
+
+      Status = SafeUintnAdd (
+                 CipherStringSize,
+                 AsciiStrLen (SSL_CIPHER_get_name (OpensslCipher)),
+                 &CipherStringSize
+                 );
+      if (EFI_ERROR (Status)) {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto FreeMappedCipher;
+      }
+
+      //
+      // Record the mapping.
+      //
+      MappedCipher[MappedCipherCount++] = OpensslCipher;
+      break;
     }
 
     if (StackIdx == sk_SSL_CIPHER_num (OpensslCipherStack)) {
@@ -245,36 +274,7 @@ TlsSetCipherList (
       // preference list of ciphers, thus we can filter it as long as we
       // don't change the relative order of elements on it.
       //
-      continue;
     }
-
-    //
-    // Accumulate cipher name string length into CipherStringSize. If this
-    // is not the first successful mapping, account for a colon (":") prefix
-    // too.
-    //
-    if (MappedCipherCount > 0) {
-      Status = SafeUintnAdd (CipherStringSize, 1, &CipherStringSize);
-      if (EFI_ERROR (Status)) {
-        Status = EFI_OUT_OF_RESOURCES;
-        goto FreeMappedCipher;
-      }
-    }
-
-    Status = SafeUintnAdd (
-               CipherStringSize,
-               AsciiStrLen (SSL_CIPHER_get_name (OpensslCipher)),
-               &CipherStringSize
-               );
-    if (EFI_ERROR (Status)) {
-      Status = EFI_OUT_OF_RESOURCES;
-      goto FreeMappedCipher;
-    }
-
-    //
-    // Record the mapping.
-    //
-    MappedCipher[MappedCipherCount++] = OpensslCipher;
   }
 
   //