<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Calling <code>memset</code> or <code>bzero</code> on a buffer to clear its contents may get optimized

away by the compiler if the buffer is not subsequently used. This is not desirable behavior if the buffer

contains sensitive data that could somehow be retrieved by an attacker.</p>

</overview>

<recommendation>

<p>Use <code>memset_s</code> (from C11) instead of <code>memset</code>, as <code>memset_s</code> will not

get optimized away. Alternatively use platform-supplied functions such as <code>SecureZeroMemory</code> or

<code>bzero_explicit</code> that make the same guarantee. Passing the <code>-fno-builtin-memset</code>

option to the GCC/Clang compiler usually also prevents the optimization. Finally, you can use the

public-domain <code>secure_memzero</code> function (see references below). This function, however, is not

guaranteed to work on all platforms and compilers.</p>

</recommendation>

<example>

<p>The following program fragment uses <code>memset</code> to erase sensitive information after it is no

longer needed:</p>

<sample src="MemsetMayBeDeleted-bad.c" />

<p>Because of dead store elimination, the call to <code>memset</code> may be removed by the compiler

(since the buffer is not subsequently used), resulting in potentially sensitive data remaining in memory.

</p>

<p>The best solution to this problem is to use the <code>memset_s</code> function instead of

<code>memset</code>:</p>

<sample src="MemsetMayBeDeleted-good.c" />

</example>

<references>

<li>

CERT C Coding Standard:

<a href="https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations">MSC06-C. Beware of compiler optimizations</a>.

</li>

<li>

USENIX: The Advanced Computing Systems Association:

<a href="https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-yang.pdf">Dead Store Elimination (Still) Considered Harmfuls</a>

</li>

</references>

</qhelp>