The right answer should be memset_explicit(). I was disappointed that this article never mentioned the Standard solution to this issue, or pre-standard versions such as explicit_bzero(). But I don’t think that omission makes much difference because clang and gcc don’t seem to know enough about memset_explicit() to avoid a spill to memory.

Unfortunately memset_s() is entangled with the Annex K portability problems and its crazy runtime constraint checking and exception handling, which makes it hard for compilers to implement memset_s() as a sensible builtin.

The special case for for memset_s() is:

Unlike memset, any call to the memset_s function shall be evaluated strictly according to the rules of the abstract machine as described in 5.1.2.4. That is, any call to the memset_s function shall assume that the memory indicated by s and n may be accessible in the future and thus contains the values indicated by c.

And for memset_explicit():

The purpose of this function is to make sensitive information stored in the object inaccessible. (footnote: The intention is that the memory store is always performed (i.e. never elided), regardless of optimizations. This is in contrast to calls to the memset function (7.26.6.1).)

score 1 · canonical