From: Kees Cook > Sent: 12 February 2022 00:38 .... > > Sure. I think I am trying to take a pragmatic approach here, which is > that gaining auto-var-init is a big deal (killing entire classes of > vulnerabilities), but it comes with an annoying compiler bug (that we do > get a warning about) for an uncommon code pattern that is easy to fix. My worry about the compiler setting variables to zero is that people will get lazy and assume it happens. Then some code will get compiled without that enabled (possibly because it slows things down too much) and then really horrid bugs start to appear. If the intent is to detect code that is failing to initialise locals then setting to a non-zero value (that is likely to cause grief) is much better than setting to zero. I'm particularly worried if the compiler starts to zero on-stack arrays. There is plenty of userspace code that will use char buff[MAX_PATH] to build a filename or char errmsg[1024] for an error message. At the moment the size only needs to be 'big enough' but if the compiler zeros it then there are performance issues and oversize buffers make a difference. At which point you start making the arrays 'just big enough' and then fall foul of truncations and overruns because the calculation was wrong. Definitely double edged. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
