From 3b1f9031fac26ae94e44ebcdf13ee06c660e9018 Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Fri, 21 Aug 2026 15:58:45 -0600
Subject: [PATCH] F-6153: zeroize full RSA decrypt output buffer before free

---
 jni/jni_rsa.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/jni/jni_rsa.c b/jni/jni_rsa.c
index 976ba99c..6a86dfdf 100644
--- a/jni/jni_rsa.c
+++ b/jni/jni_rsa.c
@@ -1016,7 +1016,7 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt(
     RsaKey* key = NULL;
     byte* ciphertext = NULL;
     byte* output = NULL;
-    word32 size = 0, outputSz = 0;
+    word32 size = 0, outputSz = 0, outputBufSz = 0;
     int encSz = 0;
 
     key = (RsaKey*) getNativeStruct(env, this);
@@ -1041,6 +1041,9 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt(
             ret = BAD_FUNC_ARG;
         } else {
             outputSz = (word32)encSz;
+            /* Keep full allocation size for zeroization, outputSz shrinks
+             * to plaintext len after decrypt */
+            outputBufSz = outputSz;
         }
     }
 
@@ -1081,9 +1084,9 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt(
     if (output != NULL) {
         #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
             !defined(WOLFSSL_NO_FORCE_ZERO)
-            wc_ForceZero(output, outputSz);
+            wc_ForceZero(output, outputBufSz);
         #else
-            XMEMSET(output, 0, outputSz);
+            XMEMSET(output, 0, outputBufSz);
         #endif
         XFREE(output, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
@@ -1207,7 +1210,7 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt_1ex(
     RsaKey* key = NULL;
     byte* ciphertext = NULL;
     byte* output = NULL;
-    word32 size = 0, outputSz = 0;
+    word32 size = 0, outputSz = 0, outputBufSz = 0;
     int encSz = 0;
 
     key = (RsaKey*) getNativeStruct(env, this);
@@ -1237,6 +1240,9 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt_1ex(
             ret = BAD_FUNC_ARG;
         } else {
             outputSz = (word32)encSz;
+            /* Keep full allocation size for zeroization, outputSz shrinks to
+             * the plaintext len after decrypt */
+            outputBufSz = outputSz;
         }
     }
 
@@ -1277,9 +1283,9 @@ Java_com_wolfssl_wolfcrypt_Rsa_wc_1RsaPrivateDecrypt_1ex(
     if (output != NULL) {
         #if (LIBWOLFSSL_VERSION_HEX >= 0x05008004) && \
             !defined(WOLFSSL_NO_FORCE_ZERO)
-            wc_ForceZero(output, outputSz);
+            wc_ForceZero(output, outputBufSz);
         #else
-            XMEMSET(output, 0, outputSz);
+            XMEMSET(output, 0, outputBufSz);
         #endif
         XFREE(output, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }