As noted from Issue #414, it appears that compilers are optimizing out the clearing of sensitive memory.
There are a few ways to work around these shortcomings, discussed in CWE-14 and MSC06-C.
Options include:
- Casting to
volatile
during assignment - Rolling your own
memset_s
or using C11’s version - Temporarily disabling optimization using
#pragma
(probably not portable)