The C language specification allows the compiler to remove unnecessary code during the optimization phase. For example, when a memory buffer is
about to be destroyed, any writes to that buffer may be seen as unnecessary to the operation of the program. The compiler may choose to remove these
write operations.
When the memset
function is used to clear sensitive data from memory and that memory is destroyed immediately afterward, the compiler
may see the memset
call as unnecessary and remove it. The sensitive data will, therefore, remain in memory.
This rule raises an issue when a call to memset
is followed by the destruction of the buffer.