Re:A public TrueCrypt Audit
by tribaal on Thursday October 10, 2013 @02:50AM
(#6526074)
I'm not a specialist, but wouldn't a call to free simply deference the memory, but not zero it out? you can then probably still find the key by inspecting memory? again, I'm not a good C programmer, I would like to know too :)
[ Parent
| on HN ]
Re:A public TrueCrypt Audit
by foobarbazqux on Thursday October 10, 2013 @04:49AM
(#6526402)
Yeah, you'd still need to call memset before free. Compilers have a much harder time convincing themselves of things about pointers, so it should survive dead code elimination.