Lacking a proof that--for this implementation--exposure of Montgomery

multiplication or RSA blinding parameters doesn't permit retroactive
timing analysis of the secrets, we'll do the stupidly cheap thing and
cleanse them before freeing them.

ok deraadt@

1 files changed, 4 insertions, 4 deletions

diff --git a/src/lib/libcrypto/bn/bn_blind.c b/src/lib/libcrypto/bn/bn_blind.c
index 264531013e..f424e479d3 100644
--- a/src/lib/libcrypto/bn/bn_blind.c
+++ b/src/lib/libcrypto/bn/bn_blind.c
@@ -176,10 +176,10 @@ void BN_BLINDING_free(BN_BLINDING *r)
         if(r == NULL)
             return;
 
-        if (r->A  != NULL) BN_free(r->A );
-        if (r->Ai != NULL) BN_free(r->Ai);
-        if (r->e  != NULL) BN_free(r->e );
-        if (r->mod != NULL) BN_free(r->mod); 
+        if (r->A  != NULL) BN_clear_free(r->A );
+        if (r->Ai != NULL) BN_clear_free(r->Ai);
+        if (r->e  != NULL) BN_clear_free(r->e );
+        if (r->mod != NULL) BN_clear_free(r->mod); 
         free(r);
         }