From 3e96f7b1bc8436a4200c9d35845d08e92cd3194d Mon Sep 17 00:00:00 2001
From: Aidan Keefe <aidan.keefe@wolfssl.com>
Date: Wed, 5 Aug 2026 16:53:37 -0600
Subject: [PATCH] protect against null deref and zero sensitive memory

---
 src/genkey/clu_genkey.c | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/src/genkey/clu_genkey.c b/src/genkey/clu_genkey.c
index e129096d..0093c104 100644
--- a/src/genkey/clu_genkey.c
+++ b/src/genkey/clu_genkey.c
@@ -921,10 +921,20 @@ int wolfCLU_genKey_RSA(WC_RNG* rng, char* fName, int directive, int fmt, int
 
             XFCLOSE(file);
             file = NULL;
-            XFREE(derBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
-            derBuf = NULL;
-            XFREE(pemBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
-            pemBuf = NULL;
+            if (derBuf != NULL) {
+                if (derBufSz > 0) {
+                    wc_ForceZero(derBuf, (word32)derBufSz);
+                }
+                XFREE(derBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+                derBuf = NULL;
+            }
+            if (pemBuf != NULL) {
+                if (pemBufSz > 0) {
+                    wc_ForceZero(pemBuf, (word32)pemBufSz);
+                }
+                XFREE(pemBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+                pemBuf = NULL;
+            }
 
             FALL_THROUGH;
         case PUB_ONLY_FILE:
@@ -1014,10 +1024,18 @@ int wolfCLU_genKey_RSA(WC_RNG* rng, char* fName, int directive, int fmt, int
         fOutNameBuf = NULL;
     }
     if (derBuf != NULL) {
+        if (derBufSz > 0) {
+            wc_ForceZero(derBuf, (word32)derBufSz);
+        }
         XFREE(derBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+        derBuf = NULL;
     }
     if (pemBuf != NULL) {
+        if (pemBufSz > 0) {
+            wc_ForceZero(pemBuf, (word32)pemBufSz);
+        }
         XFREE(pemBuf, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+        pemBuf = NULL;
     }
      if (file != NULL) {
         XFCLOSE(file);