Problem - Kevin Tafuro

memory location will generally still have the unaltered data, up until the point where
the memory manager reallocates the data and the program overwrites the value.
Another pitfall is that functions like memset( ) may fail to wipe data because of compiler
optimizations.
Compiler writers have worked hard to implement optimizations into their compilers
to help make code run faster (or compile to smaller machine code). Some of these
optimizations can realize significant performance gains, but sometimes they also
come at a cost. One such optimization is dead-code elimination, where the optimizer
attempts to identify code that does nothing and eliminate it. Only relatively
new compilers seem to implement this optimization; these include the current versions
of GCC and Microsoft’s Visual C++ compiler, as well as some other less commonly
used compilers.
Unfortunately, this optimization can cause problems when writing secure code. Most
commonly, code that “erases” a piece of memory that contains sensitive information
such as a password or passphrase in plaintext is often eliminated by this optimization.
As a result, the sensitive information is left in memory, providing an attacker a
temptation that can be difficult to ignore.
Functions like memset( ) do useful work, so why would dead-code elimination passes
remove them? Many compilers implement such functions as built-ins, which means
that the compiler has knowledge of what the function does. In addition, situations in
which such calls would be eliminated are restricted to times when the compiler can
be sure that the data written by these functions is never read again. For example:
int get_and_verify_password(char *real_password) {
int result;
char *user_password[64];
/* WARNING * WARNING * WARNING * WARNING * WARNING * WARNING * WARNING
*
* This is an example of unsafe code. In particular, note the use of memset( ),
* which is exactly what we are discussing as being a problem in this recipe.
*/
get_password_from_user_somehow(user_password, sizeof(user_password));
result = !strcmp(user_password, real_password);
memset(user_password, 0, strlen(user_password));
return result;
}
In this example, the variable user_password exists solely within the function get_and_
verify_password( ). After the memset( ), it’s never used again, and because memset( )
only writes the data, the compiler can “safely” remove it.
Several solutions to this particular problem exist, but the code that we’ve provided
here is the most correct when used with a compiler that conforms to at least the
Erasing Data from Memory Securely | 705
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.