File openssl-0006-CAST_set_key.patch of Package openssl-3

Description: Fix CWE-457 (Use of Uninitialized Value) in CAST_set_key
Issue: The 'k' array (size 32) is only partially initialized based on 'len'. However, the key schedule loop reads indices up to i+16 (where i=0..15), accessing potentially uninitialized stack memory at k[16..31].

Index: openssl-3.6.0/crypto/cast/c_skey.c
===================================================================
--- openssl-3.6.0.orig/crypto/cast/c_skey.c
+++ openssl-3.6.0/crypto/cast/c_skey.c
@@ -33,7 +33,7 @@ void CAST_set_key(CAST_KEY *key, int len
 {
     CAST_LONG x[16];
     CAST_LONG z[16];
-    CAST_LONG k[32];
+    CAST_LONG k[32] = {0};
     CAST_LONG X[4], Z[4];
     CAST_LONG l, *K;
     int i;