From 3cfec8b3d244e67f2d6fc7e5fc247215afb986bd Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Tue, 3 Mar 2026 11:30:08 -0800
Subject: [PATCH] Missing ForceZero on plaintext password copy

When a copy of the user's password is freed, it wasn't getting force
zeroed. It might still exist in the heap after getting freed.  Added
a call to `ForceZero()`.

Affected function: CheckPasswordUnix.
Issue: F-56
---
 apps/wolfsshd/auth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/wolfsshd/auth.c b/apps/wolfsshd/auth.c
index 65a61d64..e5cf6c51 100644
--- a/apps/wolfsshd/auth.c
+++ b/apps/wolfsshd/auth.c
@@ -430,6 +430,7 @@ static int CheckPasswordUnix(const char* usr, const byte* pw, word32 pwSz, WOLFS
     }
 
     if (pwStr != NULL) {
+        ForceZero(pwStr, pwSz + 1);
         WFREE(pwStr, NULL, DYNTYPE_STRING);
     }
     if (storedHashCpy != NULL) {