Clear signature outputs with mld_zeroize on failure

Scrub the detached-signature buffer on error paths with mld_zeroize
rather than memset, matching key generation and pk_from_sk.

This is a conservative measure. A plain memset of an output buffer is
not a dead store while the signing routine is a separate call, so the
compiler will not remove it; it could only be optimized away if the
routine were inlined into a caller that discards the signature.

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Author: mkannwischer

mldsa/src/sign.c

@@ -1050,7 +1050,7 @@ int mld_sign_signature_internal(uint8_t sig[MLDSA_CRYPTO_BYTES],
   if (ret != 0)
   {
     /* To be on the safe-side, we zeroize the signature buffer. */
-    mld_memset(sig, 0, MLDSA_CRYPTO_BYTES);
+    mld_zeroize(sig, MLDSA_CRYPTO_BYTES);
   }
 
   /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
@@ -1111,9 +1111,9 @@ int mld_sign_signature(uint8_t sig[MLDSA_CRYPTO_BYTES], const uint8_t *m,
      * the case of error.
      *
      * If we come from mld_sign_signature_internal, this is redundant, but the
-     * error case should not be the norm, and the added cost of the memset
+     * error case should not be the norm, and the added cost of the zeroization
      * insignificant. */
-    mld_memset(sig, 0, MLDSA_CRYPTO_BYTES);
+    mld_zeroize(sig, MLDSA_CRYPTO_BYTES);
   }
 
   /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */
@@ -1370,9 +1370,9 @@ int mld_sign_signature_pre_hash_internal(
      * the case of error.
      *
      * If we come from mld_sign_signature_internal, this is redundant, but the
-     * error case should not be the norm, and the added cost of the memset
+     * error case should not be the norm, and the added cost of the zeroization
      * insignificant. */
-    mld_memset(sig, 0, MLDSA_CRYPTO_BYTES);
+    mld_zeroize(sig, MLDSA_CRYPTO_BYTES);
   }
 
   /* @[FIPS204, Section 3.6.3] Destruction of intermediate values. */