ForceZero hmac buffer in Tls13IntegrityOnly_Decrypt before return F-1466

julek-wolfssl · julek-wolfssl · commit b72a2133fc86 · 2026-04-03T10:34:55.000+02:00
diff --git a/src/tls13.c b/src/tls13.c
@@ -2968,6 +2968,7 @@ static int Tls13IntegrityOnly_Decrypt(WOLFSSL* ssl, byte* output,
     /* Copy the input to output if not the same buffer */
     if (ret == 0 && output != input)
         XMEMCPY(output, input, sz);
+    ForceZero(hmac, sizeof(hmac));
     return ret;
 }
 #endif

Original file line number	Diff line number	Diff line change
`@@ -2968,6 +2968,7 @@ static int Tls13IntegrityOnly_Decrypt(WOLFSSL* ssl, byte* output,`
`2968`	`2968`	`/* Copy the input to output if not the same buffer */`
`2969`	`2969`	`if (ret == 0 && output != input)`
`2970`	`2970`	`XMEMCPY(output, input, sz);`
	`2971`	`+ ForceZero(hmac, sizeof(hmac));`
`2971`	`2972`	`return ret;`
`2972`	`2973`	`}`
`2973`	`2974`	`#endif`