From 97486f7d454d83ce830589c43328099e385c3c23 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Tue, 18 Jul 2017 20:16:47 +0200
Subject: [PATCH] Clear the BLAKE2B state only once, on finalization

No need to clear everything, and no need to clear again
if _final() is called more than once.
---
 src/libsodium/crypto_generichash/blake2b/ref/blake2b-ref.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/libsodium/crypto_generichash/blake2b/ref/blake2b-ref.c b/src/libsodium/crypto_generichash/blake2b/ref/blake2b-ref.c
index 43f38002..1a051283 100644
--- a/src/libsodium/crypto_generichash/blake2b/ref/blake2b-ref.c
+++ b/src/libsodium/crypto_generichash/blake2b/ref/blake2b-ref.c
@@ -359,7 +359,6 @@ blake2b_final(blake2b_state *S, uint8_t *out, uint8_t outlen)
         sodium_misuse("blake2b_final(): unsupported output length");
     }
     if (blake2b_is_lastblock(S)) {
-        sodium_memzero(S, sizeof *S);
         return -1;
     }
     if (S->buflen > BLAKE2B_BLOCKBYTES) {
@@ -389,6 +388,9 @@ blake2b_final(blake2b_state *S, uint8_t *out, uint8_t outlen)
         memcpy(out, buffer, outlen);
     }
 #endif
+    sodium_memzero(S->h, sizeof S->h);
+    sodium_memzero(S->buf, sizeof S->buf);
+
     return 0;
 }