===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-dss.c,v
retrieving revision 1.30
retrieving revision 1.31
diff -u -r1.30 -r1.31
--- src/usr.bin/ssh/ssh-dss.c	2014/01/09 23:20:00	1.30
+++ src/usr.bin/ssh/ssh-dss.c	2014/02/02 03:44:31	1.31
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-dss.c,v 1.30 2014/01/09 23:20:00 djm Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.31 2014/02/02 03:44:31 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -62,7 +62,7 @@
 	}
 
 	sig = DSA_do_sign(digest, dlen, key->dsa);
-	memset(digest, 'd', sizeof(digest));
+	explicit_bzero(digest, sizeof(digest));
 
 	if (sig == NULL) {
 		error("ssh_dss_sign: sign failed");
@@ -76,7 +76,7 @@
 		DSA_SIG_free(sig);
 		return -1;
 	}
-	memset(sigblob, 0, SIGBLOB_LEN);
+	explicit_bzero(sigblob, SIGBLOB_LEN);
 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
 	DSA_SIG_free(sig);
@@ -165,7 +165,7 @@
 		fatal("%s: BN_bin2bn failed", __func__);
 
 	/* clean up */
-	memset(sigblob, 0, len);
+	explicit_bzero(sigblob, len);
 	free(sigblob);
 
 	/* sha1 the data */
@@ -176,7 +176,7 @@
 	}
 
 	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
-	memset(digest, 'd', sizeof(digest));
+	explicit_bzero(digest, sizeof(digest));
 
 	DSA_SIG_free(sig);