===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/auth2-passwd.c,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- src/usr.bin/ssh/auth2-passwd.c	2021/12/19 22:12:07	1.20
+++ src/usr.bin/ssh/auth2-passwd.c	2022/05/27 04:29:40	1.21
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-passwd.c,v 1.20 2021/12/19 22:12:07 djm Exp $ */
+/* $OpenBSD: auth2-passwd.c,v 1.21 2022/05/27 04:29:40 dtucker Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -49,16 +49,18 @@
 static int
 userauth_passwd(struct ssh *ssh, const char *method)
 {
-	char *password;
+	char *password = NULL;
 	int authenticated = 0, r;
 	u_char change;
-	size_t len;
+	size_t len = 0;
 
 	if ((r = sshpkt_get_u8(ssh, &change)) != 0 ||
 	    (r = sshpkt_get_cstring(ssh, &password, &len)) != 0 ||
 	    (change && (r = sshpkt_get_cstring(ssh, NULL, NULL)) != 0) ||
-	    (r = sshpkt_get_end(ssh)) != 0)
+	    (r = sshpkt_get_end(ssh)) != 0) {
+		freezero(password, len);
 		fatal_fr(r, "parse packet");
+	}
 
 	if (change)
 		logit("password change not supported");