From afa803775a1bf4f5bd0cd147bf4984785b576a04 Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Tue, 11 Sep 2018 15:35:41 +0200
Subject: [PATCH] HMAC_DRBG: clean stack buffers

Wipe stack buffers that may contain sensitive data (data that
contributes to the DRBG state.
---
 library/hmac_drbg.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c
index dad55ff86..65c8daccd 100644
--- a/library/hmac_drbg.c
+++ b/library/hmac_drbg.c
@@ -89,6 +89,8 @@ void mbedtls_hmac_drbg_update( mbedtls_hmac_drbg_context *ctx,
         mbedtls_md_hmac_update( &ctx->md_ctx, ctx->V, md_len );
         mbedtls_md_hmac_finish( &ctx->md_ctx, ctx->V );
     }
+
+    mbedtls_platform_zeroize( K, sizeof( K ) );
 }
 
 /*
@@ -154,6 +156,7 @@ int mbedtls_hmac_drbg_reseed( mbedtls_hmac_drbg_context *ctx,
     ctx->reseed_counter = 1;
 
     /* 4. Done */
+    mbedtls_platform_zeroize( seed, seedlen );
     return( 0 );
 }