From 246b1634ff6be81d956d7c7c60d7edb13e701f2d Mon Sep 17 00:00:00 2001
From: Andres Amaya Garcia <andres.amayagarcia@arm.com>
Date: Fri, 7 Jul 2017 10:46:51 +0100
Subject: [PATCH] Zeroize buf if mbedtls_base64_decode() fails

---
 library/pem.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/library/pem.c b/library/pem.c
index a09257cc7..ea36df882 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -331,6 +331,7 @@ int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const
 
     if( ( ret = mbedtls_base64_decode( buf, len, &len, s1, s2 - s1 ) ) != 0 )
     {
+        mbedtls_zeroize( buf, len );
         mbedtls_free( buf );
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
     }