From fbd259aac1031f38beaace85d817b638a42504fd Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Thu, 20 Aug 2026 15:17:31 -0600 Subject: [PATCH] F-5049: zeroize native AES-CCM key copy before JNI release --- jni/jni_aesccm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jni/jni_aesccm.c b/jni/jni_aesccm.c index 323c197d..dbada278 100644 --- a/jni/jni_aesccm.c +++ b/jni/jni_aesccm.c @@ -117,6 +117,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesCcm_wc_1AesCcmSetKey Aes* aes = NULL; const byte* key = NULL; word32 keyLen = 0; + jboolean keyIsCopy = JNI_FALSE; aes = (Aes*) getNativeStruct(env, this); if ((*env)->ExceptionOccurred(env)) { @@ -125,7 +126,8 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesCcm_wc_1AesCcmSetKey } if (keyArr != NULL) { - key = (const byte*)(*env)->GetByteArrayElements(env, keyArr, NULL); + key = (const byte*)(*env)->GetByteArrayElements(env, keyArr, + &keyIsCopy); keyLen = (*env)->GetArrayLength(env, keyArr); } @@ -138,6 +140,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesCcm_wc_1AesCcmSetKey } if (keyArr != NULL) { + zeroizeByteArrayCopy((byte*)key, keyLen, keyIsCopy); (*env)->ReleaseByteArrayElements(env, keyArr, (jbyte*)key, JNI_ABORT); }