--- old/usr/src/lib/pkcs11/pkcs11_softtoken/common/softKeystore.c	Fri Jul  6 15:55:10 2018
+++ new/usr/src/lib/pkcs11/pkcs11_softtoken/common/softKeystore.c	Fri Jul  6 15:55:10 2018
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2018, Joyent, Inc.
  */
 
 #include <crypt.h>
@@ -98,8 +99,11 @@
 	}
 
 	if ((*result = crypt((char *)pPin, *salt)) == NULL) {
-		if (new_salt)
-			free(*salt);
+		if (new_salt) {
+			size_t saltlen = strlen(*salt) + 1;
+
+			freezero(*salt, saltlen);
+		}
 		return (-1);
 	}
 
@@ -119,6 +123,7 @@
 	uchar_t	*tmp_pin = NULL;
 	boolean_t pin_initialized = B_FALSE;
 	CK_RV	rv = CKR_OK;
+	size_t	len = 0;
 
 	/*
 	 * Check to see if keystore is initialized.
@@ -189,13 +194,18 @@
 	}
 
 cleanup:
-	if (salt)
-		free(salt);
-	if (tmp_pin)
-		free(tmp_pin);
-	if (ks_cryptpin)
-		free(ks_cryptpin);
-
+	if (salt) {
+		len = strlen(salt) + 1;
+		freezero(salt, len);
+	}
+	if (tmp_pin) {
+		len = strlen((char *)tmp_pin) + 1;
+		freezero(tmp_pin, len);
+	}
+	if (ks_cryptpin) {
+		len = strlen(ks_cryptpin) + 1;
+		freezero(ks_cryptpin, len);
+	}
 	return (rv);
 }
 
@@ -213,6 +223,7 @@
 	boolean_t pin_initialized = B_FALSE;
 	uchar_t	*tmp_old_pin = NULL, *tmp_new_pin = NULL;
 	CK_RV	rv = CKR_OK;
+	size_t	len = 0;
 
 	/*
 	 * Check to see if keystore is initialized.
@@ -290,14 +301,22 @@
 	}
 
 cleanup:
-	if (salt)
-		free(salt);
-	if (ks_cryptpin)
-		free(ks_cryptpin);
-	if (tmp_old_pin)
-		free(tmp_old_pin);
-	if (tmp_new_pin)
-		free(tmp_new_pin);
+	if (salt) {
+		len = strlen(salt) + 1;
+		freezero(salt, len);
+	}
+	if (ks_cryptpin) {
+		len = strlen(ks_cryptpin) + 1;
+		freezero(ks_cryptpin, len);
+	}
+	if (tmp_old_pin) {
+		len = strlen((char *)tmp_old_pin) + 1;
+		freezero(tmp_old_pin, len);
+	}
+	if (tmp_new_pin) {
+		len = strlen((char *)tmp_new_pin) + 1;
+		freezero(tmp_new_pin, len);
+	}
 
 	return (rv);
 }
@@ -475,9 +494,7 @@
 		}
 
 		rv = soft_add_extra_attr(&template, obj);
-		if (template.pValue) {
-			free(template.pValue);
-		}
+		freezero(template.pValue, template.ulValueLen);
 
 		if (rv != CKR_OK) {
 			return (rv);
@@ -543,7 +560,7 @@
 		rv = get_bigint_attr_from_template(key_dest, &template);
 	}
 
-	free(template.pValue);
+	freezero(template.pValue, template.ulValueLen);
 	if (rv != CKR_OK) {
 		return (rv);
 	}
@@ -1857,25 +1874,15 @@
 		return (rv);
 
 	(void) pthread_mutex_lock(&soft_slot.slot_mutex);
-	if (objp->object_type == TOKEN_PUBLIC) {
-		if ((soft_keystore_put_new_obj(buf, len, B_TRUE,
-		    B_FALSE, &objp->ks_handle)) == -1) {
-			(void) pthread_mutex_unlock(&soft_slot.slot_mutex);
-			free(buf);
-			return (CKR_FUNCTION_FAILED);
-		}
-	} else {
-		if ((soft_keystore_put_new_obj(buf, len, B_FALSE,
-		    B_FALSE, &objp->ks_handle)) == -1) {
-			(void) pthread_mutex_unlock(&soft_slot.slot_mutex);
-			free(buf);
-			return (CKR_FUNCTION_FAILED);
-		}
+	if (soft_keystore_put_new_obj(buf, len,
+	    !!(objp->object_type == TOKEN_PUBLIC), B_FALSE,
+	    &objp->ks_handle) == -1) {
+		rv = CKR_FUNCTION_FAILED;
 	}
 	(void) pthread_mutex_unlock(&soft_slot.slot_mutex);
-	free(buf);
-	return (CKR_OK);
 
+	freezero(buf, len);
+	return (rv);
 }
 
 /*
@@ -1897,11 +1904,11 @@
 	/* B_TRUE: caller has held a writelock on the keystore */
 	if (soft_keystore_modify_obj(&objp->ks_handle, buf, len,
 	    B_TRUE) < 0) {
-		return (CKR_FUNCTION_FAILED);
+		rv = CKR_FUNCTION_FAILED;
 	}
 
-	free(buf);
-	return (CKR_OK);
+	freezero(buf, len);
+	return (rv);
 
 }
 
@@ -1942,8 +1949,7 @@
 
 		/* Free the ks_obj list */
 		ks_obj_next = ks_obj->next;
-		if (ks_obj->buf)
-			free(ks_obj->buf);
+		freezero(ks_obj->buf, ks_obj->size);
 		free(ks_obj);
 		ks_obj = ks_obj_next;
 	}
@@ -1953,7 +1959,7 @@
 cleanup:
 	while (ks_obj) {
 		ks_obj_next = ks_obj->next;
-		free(ks_obj->buf);
+		freezero(ks_obj->buf, ks_obj->size);
 		free(ks_obj);
 		ks_obj = ks_obj_next;
 	}
@@ -2304,9 +2310,8 @@
 		    soft_aes_ctx->ivec);
 
 		if (soft_aes_ctx->aes_cbc == NULL) {
-			bzero(soft_aes_ctx->key_sched,
+			freezero(soft_aes_ctx->key_sched,
 			    soft_aes_ctx->keysched_len);
-			free(soft_aes_ctx->key_sched);
 			if (encrypt) {
 				free(token_session.encrypt.context);
 				token_session.encrypt.context = NULL;
