key zeroization fix for a branch path of tls13_final_finish_mac
@@ -271,6 +271,7 @@ size_t tls13_final_finish_mac(SSL *s, const char *str, size_t slen,
key = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, finsecret,
hashlen);
+ OPENSSL_cleanse(finsecret, sizeof(finsecret));
}
if (key == NULL
