From be4b8d31942ca22ba25b2f4a531093ee270a20cf Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 9 Jul 2026 16:48:43 -0700
Subject: [PATCH] fix: zeroize DSA private key buffers

---
 src/dsa/clu_dsa.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/dsa/clu_dsa.c b/src/dsa/clu_dsa.c
index f8cb02eb..71cd04e9 100644
--- a/src/dsa/clu_dsa.c
+++ b/src/dsa/clu_dsa.c
@@ -344,10 +344,14 @@ int wolfCLU_DsaParamSetup(int argc, char** argv)
             ret = WOLFCLU_FATAL_ERROR;
         }
 
-        if (pem != NULL)
+        if (pem != NULL) {
+            wolfCLU_ForceZero(pem, pemSz);
             XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
-        if (outBuf != NULL)
+        }
+        if (outBuf != NULL) {
+            wolfCLU_ForceZero(outBuf, outBufSz);
             XFREE(outBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        }
     }
 
     wolfSSL_BIO_free(bioIn);