diff --git a/auth2-passwd.c b/auth2-passwd.c
index 4dd3816..09cf077 100644
--- a/auth2-passwd.c
+++ b/auth2-passwd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-passwd.c,v 1.9 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth2-passwd.c,v 1.12 2014/07/15 15:54:14 millert Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -41,6 +41,7 @@
 #include "ssh-gss.h"
 #endif
 #include "monitor_wrap.h"
+#include "misc.h"
 #include "servconf.h"
 
 /* import */
@@ -59,20 +60,20 @@
 	if (change) {
 		/* discard new password from packet */
 		newpass = packet_get_string(&newlen);
-		memset(newpass, 0, newlen);
-		xfree(newpass);
+		explicit_bzero(newpass, newlen);
+		free(newpass);
 	}
 	packet_check_eom();
 
 	if (change)
 		logit("password change not supported");
-#ifndef ANDROID
-	/* no password authentication in android */
+#if !defined(ANDROID)
+	/* no password authentication in Android */
 	else if (PRIVSEP(auth_password(authctxt, password)) == 1)
 		authenticated = 1;
 #endif
-	memset(password, 0, len);
-	xfree(password);
+	explicit_bzero(password, len);
+	free(password);
 	return authenticated;
 }