From 5946465a8745069afc6db1135e42a3cd718a37dc Mon Sep 17 00:00:00 2001
From: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
Date: Thu, 14 Nov 2024 04:38:27 +0000
Subject: [PATCH] fips: zeroize temporary self-check out MD variable

At least this is done on module startup only.

To satisfy ISO/IEC 19790:2012/Cor.1:2015(E) Section 7.5 [05.10]
requirement.

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25945)
---
 providers/fips/self_test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c
index 551fadecde..f4fd3f51ae 100644
--- a/providers/fips/self_test.c
+++ b/providers/fips/self_test.c
@@ -289,6 +289,7 @@ err:
     OSSL_SELF_TEST_onend(ev, ret);
     EVP_MAC_CTX_free(ctx);
     EVP_MAC_free(mac);
+    OPENSSL_cleanse(out, sizeof(out));
     return ret;
 }
 #endif /* OPENSSL_NO_FIPS_POST */