Merge remote-tracking branch 'upstream-restricted/pr/402' into mbedtls-1.3-restricted
diff --git a/ChangeLog b/ChangeLog
index 1a85af2..a47cdeb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -13,6 +13,8 @@
* Tighten should-be-constant-time memcmp against compiler optimizations.
* Ensure that buffers are cleared after use if they contain sensitive data.
Changes were introduced in multiple places in the library.
+ * Set PEM buffer to zero before freeing it, to avoid decoded private keys
+ being leaked to memory after release.
Bugfix
* Fix memory leak in ssl_set_hostname() when called multiple times.
diff --git a/library/pem.c b/library/pem.c
index 789a92d..fedbc5c 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -393,6 +393,8 @@
void pem_free( pem_context *ctx )
{
+ if ( ctx->buf != NULL )
+ polarssl_zeroize( ctx->buf, ctx->buflen );
polarssl_free( ctx->buf );
polarssl_free( ctx->info );