f287 harden wc_DhImportKeyPair

embhorn · embhorn · commit 203cce48ef50 · 2026-03-05T15:44:12.000-06:00
diff --git a/wolfcrypt/src/dh.c b/wolfcrypt/src/dh.c
@@ -2404,7 +2404,7 @@ int wc_DhImportKeyPair(DhKey* key, const byte* priv, word32 privSz,
     }
     if (havePriv) {
         if (mp_read_unsigned_bin(&key->priv, priv, privSz) != MP_OKAY) {
-            mp_clear(&key->priv);
+            mp_forcezero(&key->priv);
             havePriv = 0;
         } else {
             WOLFSSL_MSG("DH Private Key Set");

Original file line number	Diff line number	Diff line change
`@@ -2404,7 +2404,7 @@ int wc_DhImportKeyPair(DhKey* key, const byte* priv, word32 privSz,`
`2404`	`2404`	`}`
`2405`	`2405`	`if (havePriv) {`
`2406`	`2406`	`if (mp_read_unsigned_bin(&key->priv, priv, privSz) != MP_OKAY) {`
`2407`		`- mp_clear(&key->priv);`
	`2407`	`+ mp_forcezero(&key->priv);`
`2408`	`2408`	`havePriv = 0;`
`2409`	`2409`	`} else {`
`2410`	`2410`	`WOLFSSL_MSG("DH Private Key Set");`