Allow testing the valgrind suppression file in CI

Skip the OPENSSL_cleanup() call from the openssl app and in tests
when OSSL_USE_VALGRIND environment variable is set.

This can be used in the CI to test the valgrind suppressions.

Builds upon https://github.com/openssl/openssl/pull/29573

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Tue Feb 10 14:00:54 2026
(Merged from https://github.com/openssl/openssl/pull/29575)

1 files changed, 27 insertions, 0 deletions

diff --git a/test/testutil/main.c b/test/testutil/main.c
index 2d7c88c3831..c0d3ffe7fd3 100644
--- a/test/testutil/main.c
+++ b/test/testutil/main.c
@@ -12,6 +12,19 @@
 #include "output.h"
 #include "tu_local.h"
 
+#if defined __has_include
+/* Any compiler you're going to run valgrind on has this */
+#if __has_include(<valgrind/valgrind.h>)
+#include <valgrind/valgrind.h>
+#define OPENSSL_VALGRIND_H_INCLUDED
+#endif
+#endif /* defined(__has_include) */
+
+/*
+ * At some point we should consider looking at this function with a view to
+ * moving most/all of this into onfree handlers in OSSL_LIB_CTX.
+ */
+
 int main(int argc, char *argv[])
 {
     int ret = EXIT_FAILURE;
@@ -40,6 +53,20 @@ int main(int argc, char *argv[])
 end:
     ret = pulldown_test_framework(ret);
     test_close_streams();
+#if defined(OPENSSL_VALGRIND_H_INCLUDED) && defined(RUNNING_ON_VALGRIND)
+    /*
+     * Somewhat paradoxically, we do *NOT* want to clean up normally
+     * when running our tests using valgrind in order to test the
+     * suppression file which we will ship with the distribution. We
+     * set the OSSL_USE_VALGRIND environment variable for this
+     * purpose, but we only want to dodge cleanup when running under
+     * valgrind, *and* that environment variable is set. If you run
+     * this under valgrind without that environment variable set, it
+     * will still call OPENSSL_cleanup normally.
+     */
+    if (RUNNING_ON_VALGRIND && getenv("OSSL_USE_VALGRIND") != NULL)
+        return ret;
+#endif /* defined(OPENSSL_VALGRIND_H_INCLUDED) && defined(RUNNING_ON_VALGRIND) */
     OPENSSL_cleanup();
     return ret;
 }