Clear key buffers before free

LinuxJedi · LinuxJedi · commit d43ba514aa0c · 2026-03-20T07:33:53.000Z
F-314
diff --git a/src/internal.c b/src/internal.c
@@ -2738,7 +2738,10 @@ int WP11_Object_Copy(WP11_Object *src, WP11_Object *dest)
                         }
                     }
 
-                    XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                    if (derBuf != NULL) {
+                        ForceZero(derBuf, derSz);
+                        XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+                    }
 
                     /* Free destination key on failure */
                     if (ret != 0) {
@@ -2811,7 +2814,7 @@ int WP11_Object_Copy(WP11_Object *src, WP11_Object *dest)
 
                     /* Clean up */
                     if (derBuf != NULL) {
-                        XMEMSET(derBuf, 0, derSz); /* Clear sensitive data */
+                        ForceZero(derBuf, derSz);
                         XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
                     }
 

Original file line number	Diff line number	Diff line change
`@@ -2738,7 +2738,10 @@ int WP11_Object_Copy(WP11_Object src, WP11_Object dest)`
`2738`	`2738`	`}`
`2739`	`2739`	`}`
`2740`	`2740`
`2741`		`- XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);`
	`2741`	`+ if (derBuf != NULL) {`
	`2742`	`+ ForceZero(derBuf, derSz);`
	`2743`	`+ XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);`
	`2744`	`+ }`
`2742`	`2745`
`2743`	`2746`	`/* Free destination key on failure */`
`2744`	`2747`	`if (ret != 0) {`
`@@ -2811,7 +2814,7 @@ int WP11_Object_Copy(WP11_Object src, WP11_Object dest)`
`2811`	`2814`
`2812`	`2815`	`/* Clean up */`
`2813`	`2816`	`if (derBuf != NULL) {`
`2814`		`- XMEMSET(derBuf, 0, derSz); /* Clear sensitive data */`
	`2817`	`+ ForceZero(derBuf, derSz);`
`2815`	`2818`	`XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);`
`2816`	`2819`	`}`
`2817`	`2820`