Commit 6cfe188ea9 for openssl.org

commit 6cfe188ea9aea3515bb528ac234fbae76aa6588a
Author: Neil Horman <nhorman@openssl.org>
Date:   Thu Nov 5 15:28:03 2026 -0500

    crypto/bio/bss_dgram.c: initialise variable in BIO_CTRL_DGRAM_DETECT_PEER_ADDR

    BIO_dgram_detect_peer_addr() (that is, among other things, used
    in the QUIC stack to automatically detect peer addresses
    for independently connected sockets in QUIC connections) used
    struct sockaddr field to size the buffer for the getpername() call,
    whose size (16 bytes) was enough for IPv4 addresses, but too small
    for other address families, including IPv6 (struct sockaddr_in6
    is 28 bytes in size);  getpeername() call updated only the supplied
    part of the buffer, and the returned result size was capped using
    address-family-aware BIO_ADDR_sockaddr_size(), that led to returning
    the uninitialised stack data beyond the part updated by getpeername().

    Update the command to ensure that the BIO_ADDR variable used for this
    operation is initialized to zero, and pass the full size of the BIO_ADDR
    variable to the getpeername() call.

    Fixes: CVE-2026-88822
    Fixes: 000ef7818b24 "BIO: Add BIO_dgram_detect_peer_addr API"
    Resolves: https://github.com/openssl/openssl/issues/33457
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
    Merge-date: Sat Nov  7 15:35:04 2026
    Merged-from: https://github.com/openssl/openssl/pull/33566

diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
index 0ef973c195..94fa9eb820 100644
--- a/crypto/bio/bss_dgram.c
+++ b/crypto/bio/bss_dgram.c
@@ -745,8 +745,8 @@ static long dgram_ctrl(BIO *b, int cmd, long num, void *ptr)
         BIO_ADDR_make(&data->peer, BIO_ADDR_sockaddr((BIO_ADDR *)ptr));
         break;
     case BIO_CTRL_DGRAM_DETECT_PEER_ADDR: {
-        BIO_ADDR xaddr, *p = &data->peer;
-        socklen_t xaddr_len = sizeof(xaddr.sa);
+        BIO_ADDR xaddr = { 0 }, *p = &data->peer;
+        socklen_t xaddr_len = sizeof(xaddr);

         if (BIO_ADDR_family(p) == AF_UNSPEC) {
             if (getpeername(b->num, (void *)&xaddr.sa, &xaddr_len) == 0