mirror of
https://github.com/espressif/esp-idf.git
synced 2026-10-18 11:33:17 +03:00
esp_srp_free() released the 64-byte SHA-512 session_key buffer with a plain free(), leaving the derived session key resident in heap memory that can later be reallocated and read back. Wipe it with mbedtls_platform_zeroize() before freeing. Closes SEC-120