From e21c4d71a6cdbce63aefd8144d9f25671d6cf678 Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Thu, 5 Mar 2026 16:11:47 -0600
Subject: [PATCH 1/3] f278 fix setting heap in wc_SrpInit_ex

---
 wolfcrypt/src/srp.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/wolfcrypt/src/srp.c b/wolfcrypt/src/srp.c
index 5f51d4f5ee..60c35d6bb7 100644
--- a/wolfcrypt/src/srp.c
+++ b/wolfcrypt/src/srp.c
@@ -259,6 +259,13 @@ int wc_SrpInit_ex(Srp* srp, SrpType type, SrpSide side, void* heap, int devId)
     /* initializing variables */
     XMEMSET(srp, 0, sizeof(Srp));
 
+    /* default heap hint to NULL or test value */
+#ifdef WOLFSSL_HEAP_TEST
+    srp->heap = (void*)WOLFSSL_HEAP_TEST;
+#else
+    srp->heap = heap;
+#endif /* WOLFSSL_HEAP_TEST */
+
     if ((r = SrpHashInit(&srp->client_proof, type, srp->heap)) != 0)
         return r;
 
@@ -280,13 +287,6 @@ int wc_SrpInit_ex(Srp* srp, SrpType type, SrpSide side, void* heap, int devId)
 
     srp->keyGenFunc_cb = wc_SrpSetKey;
 
-    /* default heap hint to NULL or test value */
-#ifdef WOLFSSL_HEAP_TEST
-    srp->heap = (void*)WOLFSSL_HEAP_TEST;
-#else
-    srp->heap = heap;
-#endif /* WOLFSSL_HEAP_TEST */
-
     (void)devId; /* future */
 
     return 0;

From f28a6602737d049eed9ab8d5808ab14341c1e023 Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Thu, 5 Mar 2026 16:13:10 -0600
Subject: [PATCH 2/3] f281 harden wc_SrpInit

---
 wolfcrypt/src/srp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/wolfcrypt/src/srp.c b/wolfcrypt/src/srp.c
index 60c35d6bb7..8c57bc24d0 100644
--- a/wolfcrypt/src/srp.c
+++ b/wolfcrypt/src/srp.c
@@ -300,8 +300,8 @@ int wc_SrpInit(Srp* srp, SrpType type, SrpSide side)
 void wc_SrpTerm(Srp* srp)
 {
     if (srp) {
-        mp_clear(&srp->N);    mp_clear(&srp->g);
-        mp_clear(&srp->auth); mp_clear(&srp->priv);
+        mp_clear(&srp->N);       mp_clear(&srp->g);
+        mp_forcezero(&srp->auth); mp_forcezero(&srp->priv);
         if (srp->salt) {
             ForceZero(srp->salt, srp->saltSz);
             XFREE(srp->salt, srp->heap, DYNAMIC_TYPE_SRP);

From 25f8d6d54adb5c006b5659cfb2c5de45bcdd17ca Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Thu, 5 Mar 2026 16:14:16 -0600
Subject: [PATCH 3/3] f282 harden wc_SrpComputeKey

---
 wolfcrypt/src/srp.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/wolfcrypt/src/srp.c b/wolfcrypt/src/srp.c
index 8c57bc24d0..efe90ed407 100644
--- a/wolfcrypt/src/srp.c
+++ b/wolfcrypt/src/srp.c
@@ -908,30 +908,30 @@ int wc_SrpComputeKey(Srp* srp, byte* clientPubKey, word32 clientPubKeySz,
     XFREE(digest, srp->heap, DYNAMIC_TYPE_SRP);
     if (u) {
         if (r != WC_NO_ERR_TRACE(MP_INIT_E))
-            mp_clear(u);
+            mp_forcezero(u);
         XFREE(u, srp->heap, DYNAMIC_TYPE_SRP);
     }
     if (s) {
         if (r != WC_NO_ERR_TRACE(MP_INIT_E))
-            mp_clear(s);
+            mp_forcezero(s);
         XFREE(s, srp->heap, DYNAMIC_TYPE_SRP);
     }
     if (temp1) {
         if (r != WC_NO_ERR_TRACE(MP_INIT_E))
-            mp_clear(temp1);
+            mp_forcezero(temp1);
         XFREE(temp1, srp->heap, DYNAMIC_TYPE_SRP);
     }
     if (temp2) {
         if (r != WC_NO_ERR_TRACE(MP_INIT_E))
-            mp_clear(temp2);
+            mp_forcezero(temp2);
         XFREE(temp2, srp->heap, DYNAMIC_TYPE_SRP);
     }
 #else
     if (r != WC_NO_ERR_TRACE(MP_INIT_E)) {
-        mp_clear(u);
-        mp_clear(s);
-        mp_clear(temp1);
-        mp_clear(temp2);
+        mp_forcezero(u);
+        mp_forcezero(s);
+        mp_forcezero(temp1);
+        mp_forcezero(temp2);
     }
 #endif