From b3278af8dc9d6ea2e5b59863b6c6420ef0acee3c Mon Sep 17 00:00:00 2001
From: Anthony Hu <anthony@wolfssl.com>
Date: Wed, 25 Mar 2026 14:48:07 -0400
Subject: [PATCH] Fix wc_*_delete() functions (ZD 21415)

Save key->heap before calling wc_*_free(), which zeros the entire key
structure via ForceZero. The saved heap pointer is then passed to XFREE
instead of the now-zeroed key->heap.
---
 wolfcrypt/src/curve25519.c | 4 +++-
 wolfcrypt/src/dilithium.c  | 4 +++-
 wolfcrypt/src/ed25519.c    | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/wolfcrypt/src/curve25519.c b/wolfcrypt/src/curve25519.c
index bc2961aca4..f8ca74255c 100644
--- a/wolfcrypt/src/curve25519.c
+++ b/wolfcrypt/src/curve25519.c
@@ -1113,10 +1113,12 @@ curve25519_key* wc_curve25519_new(void* heap, int devId, int *result_code)
 }
 
 int wc_curve25519_delete(curve25519_key* key, curve25519_key** key_p) {
+    void* heap;
     if (key == NULL)
         return BAD_FUNC_ARG;
+    heap = key->heap;
     wc_curve25519_free(key);
-    XFREE(key, key->heap, DYNAMIC_TYPE_CURVE25519);
+    XFREE(key, heap, DYNAMIC_TYPE_CURVE25519);
     if (key_p != NULL)
         *key_p = NULL;
     return 0;
diff --git a/wolfcrypt/src/dilithium.c b/wolfcrypt/src/dilithium.c
index 8e1ea8e638..df2acea9fa 100644
--- a/wolfcrypt/src/dilithium.c
+++ b/wolfcrypt/src/dilithium.c
@@ -10737,10 +10737,12 @@ dilithium_key* wc_dilithium_new(void* heap, int devId)
 
 int wc_dilithium_delete(dilithium_key* key, dilithium_key** key_p)
 {
+    void* heap;
     if (key == NULL)
         return BAD_FUNC_ARG;
+    heap = key->heap;
     wc_dilithium_free(key);
-    XFREE(key, key->heap, DYNAMIC_TYPE_DILITHIUM);
+    XFREE(key, heap, DYNAMIC_TYPE_DILITHIUM);
     if (key_p != NULL)
         *key_p = NULL;
 
diff --git a/wolfcrypt/src/ed25519.c b/wolfcrypt/src/ed25519.c
index bf5cf590d0..1bf12f7b24 100644
--- a/wolfcrypt/src/ed25519.c
+++ b/wolfcrypt/src/ed25519.c
@@ -1047,10 +1047,12 @@ ed25519_key* wc_ed25519_new(void* heap, int devId, int *result_code)
 }
 
 int wc_ed25519_delete(ed25519_key* key, ed25519_key** key_p) {
+    void* heap;
     if (key == NULL)
         return BAD_FUNC_ARG;
+    heap = key->heap;
     wc_ed25519_free(key);
-    XFREE(key, key->heap, DYNAMIC_TYPE_ED25519);
+    XFREE(key, heap, DYNAMIC_TYPE_ED25519);
     if (key_p != NULL)
         *key_p = NULL;
     return 0;