From 8f39d8af7de12d5ac8699e54cf2fd8ae2325bcf2 Mon Sep 17 00:00:00 2001
From: Shane Lontis <shane.lontis@oracle.com>
Date: Tue, 4 Sep 2018 15:12:13 +1000
Subject: [PATCH] key zeroization fix for a branch path of
 tls13_final_finish_mac

Reviewed-by: Paul Yang <yang.yang@baishancloud.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/7110)
---
 ssl/tls13_enc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ssl/tls13_enc.c b/ssl/tls13_enc.c
index 22db2f8237..f7ab0fa470 100644
--- a/ssl/tls13_enc.c
+++ b/ssl/tls13_enc.c
@@ -271,6 +271,7 @@ size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
 
         key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finsecret,
                                            hashlen);
+        OPENSSL_cleanse(finsecret, sizeof(finsecret));
     }
 
     if (key == NULL
-- 
2.40.0