Secure-clear GMAC key schedule on free

JeremiahM37 · JeremiahM37 · commit 67939b1df52c · 2026-04-06T14:40:31.000Z
diff --git a/src/wp_gmac.c b/src/wp_gmac.c
@@ -93,10 +93,11 @@ static wp_GmacCtx* wp_gmac_new(WOLFPROV_CTX* provCtx)
 static void wp_gmac_free(wp_GmacCtx* macCtx)
 {
     if (macCtx != NULL) {
+        wc_AesFree(&macCtx->gmac.aes);
         OPENSSL_cleanse(macCtx->key, macCtx->keyLen);
         OPENSSL_cleanse(macCtx->iv, macCtx->ivLen);
         OPENSSL_clear_free(macCtx->data, macCtx->dataLen);
-        OPENSSL_free(macCtx);
+        OPENSSL_clear_free(macCtx, sizeof(*macCtx));
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -93,10 +93,11 @@ static wp_GmacCtx* wp_gmac_new(WOLFPROV_CTX* provCtx)`
`93`	`93`	`static void wp_gmac_free(wp_GmacCtx* macCtx)`
`94`	`94`	`{`
`95`	`95`	`if (macCtx != NULL) {`
	`96`	`+ wc_AesFree(&macCtx->gmac.aes);`
`96`	`97`	`OPENSSL_cleanse(macCtx->key, macCtx->keyLen);`
`97`	`98`	`OPENSSL_cleanse(macCtx->iv, macCtx->ivLen);`
`98`	`99`	`OPENSSL_clear_free(macCtx->data, macCtx->dataLen);`
`99`		`- OPENSSL_free(macCtx);`
	`100`	`+ OPENSSL_clear_free(macCtx, sizeof(*macCtx));`
`100`	`101`	`}`
`101`	`102`	`}`
`102`	`103`