Zeroise stack buffer containing private key

Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index aad56a4..d5d57aa 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -281,6 +281,7 @@
     ret = 0;
 
 cleanup:
+    mbedtls_platform_zeroize( buf, sizeof( buf ) );
     status = psa_destroy_key( key_id );
     if( ret == 0 && status != PSA_SUCCESS )
         ret = mbedtls_pk_error_from_psa( status );