Existing ‘best effort’ zeriozation for private data is hardly even best effort. At a minimum we should consider doing this via an extern-ed function and memset_s if available. No guarantees can still be provided, of course.
We might also consider wrapping the API entrance of private data handling functions like:
handle_data(){ ret=handle_data_impl(); handle_data_zero_stack(); return ret; }
Where _zero_stack uses slightly more stack than the whole callgraph for _impl and zeros it, in order to catch private data spilled onto the stack during execution before returning outside of our control.
I’m not sure where exactly where the line between best effort and security theatre is… there is only so much that can really be done (esp in portable code) here.
