zero RSA DER key buffer before free

JeremiahM37 · JeremiahM37 · commit 0aae4251a62d · 2026-03-26T17:29:59.000Z
diff --git a/wolfcrypt/src/port/kcapi/kcapi_rsa.c b/wolfcrypt/src/port/kcapi/kcapi_rsa.c
@@ -69,7 +69,10 @@ static int KcapiRsa_SetPrivKey(RsaKey* key)
         }
     }
 
-    XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    if (priv != NULL) {
+        ForceZero(priv, len);
+        XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
     return ret;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -69,7 +69,10 @@ static int KcapiRsa_SetPrivKey(RsaKey* key)`
`69`	`69`	`}`
`70`	`70`	`}`
`71`	`71`
`72`		`- XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);`
	`72`	`+ if (priv != NULL) {`
	`73`	`+ ForceZero(priv, len);`
	`74`	`+ XFREE(priv, key->heap, DYNAMIC_TYPE_TMP_BUFFER);`
	`75`	`+ }`
`73`	`76`	`return ret;`
`74`	`77`	`}`
`75`	`78`