From c948d3d2c6e9cdda1a39bb0f260555928ae01906 Mon Sep 17 00:00:00 2001
From: Frank Denis <fdenis@fastly.com>
Date: Sun, 8 Mar 2026 15:07:37 +0100
Subject: [PATCH] Add some sodium_memzero

---
 src/libsodium/crypto_secretbox/crypto_secretbox_easy.c           | 1 +
 .../xchacha20poly1305/secretbox_xchacha20poly1305.c              | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
index d1e7748b..7470f78f 100644
--- a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
+++ b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
@@ -113,6 +113,7 @@ crypto_secretbox_open_detached(unsigned char *m, const unsigned char *c,
         return -1;
     }
     if (m == NULL) {
+        sodium_memzero(subkey, sizeof subkey);
         return 0;
     }
     ACQUIRE_FENCE;
diff --git a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
index 4b9e27b0..4649332f 100644
--- a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
+++ b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
@@ -122,6 +122,7 @@ crypto_secretbox_xchacha20poly1305_open_detached(unsigned char *m,
         return -1;
     }
     if (m == NULL) {
+        sodium_memzero(subkey, sizeof subkey);
         return 0;
     }
     ACQUIRE_FENCE;