From 971a02bf3ccd4241ee55cfc866f2bd45516c55db Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Mon, 6 Apr 2026 10:14:58 -0600
Subject: [PATCH] JNI: free internal Aes struct in Gmac use after done (F-1956)

---
 jni/jni_aesgmac.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/jni/jni_aesgmac.c b/jni/jni_aesgmac.c
index 6a84660d..748d8483 100644
--- a/jni/jni_aesgmac.c
+++ b/jni/jni_aesgmac.c
@@ -226,6 +226,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1Gmac(
     authIn = getByteArray(env, authIn_object);
     authTag = getByteArray(env, authTag_object);
 
+    /* Initialize GMAC structure */
+    XMEMSET(&gmac, 0, sizeof(Gmac));
+
     if (key == NULL || iv == NULL || authIn == NULL || authTag == NULL) {
         ret = BAD_FUNC_ARG;
     }
@@ -236,9 +239,6 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1Gmac(
         authInSz = getByteArrayLength(env, authIn_object);
         authTagSz = getByteArrayLength(env, authTag_object);
 
-        /* Initialize GMAC structure */
-        XMEMSET(&gmac, 0, sizeof(Gmac));
-
         /* Set the key */
         ret = wc_GmacSetKey(&gmac, key, keySz);
 
@@ -274,6 +274,8 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1Gmac(
     releaseByteArray(env, authIn_object, authIn, JNI_ABORT);
     releaseByteArray(env, authTag_object, authTag, JNI_ABORT);
 
+    wc_AesFree(&gmac.aes);
+
     return ret;
 #else
     throwNotCompiledInException(env);
@@ -299,6 +301,9 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1GmacVerify(
     authIn = getByteArray(env, authIn_object);
     authTag = getByteArray(env, authTag_object);
 
+    /* Initialize GMAC structure */
+    XMEMSET(&gmac, 0, sizeof(Gmac));
+
     if (key == NULL || iv == NULL || authIn == NULL || authTag == NULL) {
         ret = BAD_FUNC_ARG;
     }
@@ -309,9 +314,6 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1GmacVerify(
         authInSz = getByteArrayLength(env, authIn_object);
         authTagSz = getByteArrayLength(env, authTag_object);
 
-        /* Initialize GMAC structure */
-        XMEMSET(&gmac, 0, sizeof(Gmac));
-
         /* Set the key */
         ret = wc_GmacSetKey(&gmac, key, keySz);
 
@@ -347,6 +349,8 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesGmac_wc_1GmacVerify(
     releaseByteArray(env, authIn_object, authIn, JNI_ABORT);
     releaseByteArray(env, authTag_object, authTag, JNI_ABORT);
 
+    wc_AesFree(&gmac.aes);
+
     return ret;
 #else
     throwNotCompiledInException(env);