Cleanse temporary data used to derive ECDH shared secret

Author: real-or-random

src/modules/ecdh/main_impl.h

@@ -20,6 +20,7 @@ static int ecdh_hash_function_sha256(unsigned char *output, const unsigned char
     secp256k1_sha256_write(&sha, x, 32);
     secp256k1_sha256_finalize(&sha, output);
 
+    SECP256K1_CLEANSE(sha);
     return 1;
 }
 
@@ -58,9 +59,12 @@ int secp256k1_ecdh(const secp256k1_context* ctx, unsigned char *output, const se
         secp256k1_fe_get_b32(y, &pt.y);
 
         ret = hashfp(output, x, y, data);
+        SECP256K1_CLEANSE(x);
+        SECP256K1_CLEANSE(y);
     }
 
     SECP256K1_CLEANSE(s);
+    SECP256K1_CLEANSE(pt);
     return ret;
 }