Fix: Zero kemContext in wc_HpkeDecap

aidangarske · aidangarske · commit 3eb9fd9f15da · 2026-02-24T17:54:16.000-08:00
diff --git a/wolfcrypt/src/hpke.c b/wolfcrypt/src/hpke.c
@@ -1037,6 +1037,7 @@ static int wc_HpkeDecap(Hpke* hpke, void* receiverKey, const byte* pubKey,
     }
 
     ForceZero(dh, hpke->Ndh);
+    ForceZero(kemContext, hpke->Npk * 2);
     WC_FREE_VAR_EX(dh, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);
     WC_FREE_VAR_EX(kemContext, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);
 

Original file line number	Diff line number	Diff line change
`@@ -1037,6 +1037,7 @@ static int wc_HpkeDecap(Hpke* hpke, void* receiverKey, const byte* pubKey,`
`1037`	`1037`	`}`
`1038`	`1038`
`1039`	`1039`	`ForceZero(dh, hpke->Ndh);`
	`1040`	`+ ForceZero(kemContext, hpke->Npk * 2);`
`1040`	`1041`	`WC_FREE_VAR_EX(dh, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);`
`1041`	`1042`	`WC_FREE_VAR_EX(kemContext, hpke->heap, DYNAMIC_TYPE_TMP_BUFFER);`
`1042`	`1043`