...
| Code Block | ||
|---|---|---|
| ||
// memset_s.c
void *memset_s(void \*v, int c, size_t n) {
volatile char *p = v;
while(n--)
*p++ = c;
return v;
}
// getPassword.c
extern void *memset_s(void *v, int c, size_t n);
void getPassword() {
char pwd[64];
if(retrievePassword(pwd, sizeof(pwd))) {
/*checking of password, secure operations, etc \*/
}
pwd = memset_s(pwd, 0, sizeof(pwd));
}
|
Risk Assessment
If the compiler optimizes out memory clearing code, an attacker could gain access to sensitive data.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC06-A | 2 (medium) | 2 (probable) | 2 (medium) | P8 | L2 |
...