As noted from Issue #414, it appears that compilers are optimizing out the clearing of sensitive memory.
There are a few ways to work around these shortcomings, discussed in CWE-14 and MSC06-C.
Options include:
- Casting to
volatileduring assignment - Rolling your own
memset_sor using C11’s version - Temporarily disabling optimization using
#pragma(probably not portable)