From c9e49e03ddadbefc2b1bf47ae0419fb47fb6a0a2 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 8 Sep 2026 12:53:14 -0700
Subject: [PATCH] F-12754 - Zeroize hash context and buffer in
 TPM2_HashNvPublic

---
 src/tpm2.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/tpm2.c b/src/tpm2.c
index e8825345..a0c5c95a 100644
--- a/src/tpm2.c
+++ b/src/tpm2.c
@@ -7538,6 +7538,7 @@ int TPM2_HashNvPublic(TPMS_NV_PUBLIC* nvPublic, byte* buffer, UINT16* size)
 #ifndef WOLFTPM2_NO_WOLFCRYPT
     int rc;
     int hashSize, nameAlgSize;
+    int hashInitialized = 0;
     UINT16 nameAlgValue;
     wc_HashAlg hash;
     enum wc_HashType hashType;
@@ -7573,6 +7574,7 @@ int TPM2_HashNvPublic(TPMS_NV_PUBLIC* nvPublic, byte* buffer, UINT16* size)
 
     rc = wc_HashInit(&hash, hashType);
     if (rc == 0) {
+        hashInitialized = 1;
         rc = wc_HashUpdate(&hash, hashType, packet.buf, packet.pos);
     }
     if (rc == 0) {
@@ -7589,7 +7591,11 @@ int TPM2_HashNvPublic(TPMS_NV_PUBLIC* nvPublic, byte* buffer, UINT16* size)
         rc = TPM_RC_SUCCESS;
     }
 
-    wc_HashFree(&hash, hashType);
+    if (hashInitialized) {
+        wc_HashFree(&hash, hashType);
+    }
+    TPM2_ForceZero(&hash, sizeof(hash));
+    TPM2_ForceZero(appending, sizeof(appending));
 
     return rc;
 #else