On Wed, 17 Oct 2018, Gabriel Zachmann wrote:

>> This, plus zeroing buffers is really hard.
>
> I understand that this is not quite easy. However, while we won't find an
> optimal solution, I think we can do better. Zeroing memory might not succeed
> in all cases and there might be still some parts left on the stack,
> register, etc. But I think we can still memsetting most and it will be much
> harder to get sensitive information.

Any suggestion on how to do this and make sure the compiler doesn't remove the
memset() ?

Also, are you suggesting we clear the memory for all frees? If yes, then we
need to keep track of the sizes somehow and if no, then we need to figure out
which ones and deal with the appropriately.

Can we come up with a way to measure this if we are doing this right or not?

-- 
  / daniel.haxx.se
-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette:   https://curl.haxx.se/mail/etiquette.html