RafaelOstertag / yapet

YAPET is a text based password manager using AES-256 encryption
https://yapet.guengel.ch/
Other
11 stars 3 forks source link

Test failure in SecureArray #27

Open vpa1977 opened 7 months ago

vpa1977 commented 7 months ago

During build the following test failure occurs:

1) test: should set empty array upon destruction (F) line: 106 securearray.cc
assertion failed
- Expression: array[i] != 42

This is due to use of `std::memset`` [2]

std::memset may be optimized away (under the [as-if](https://en.cppreference.com/w/cpp/language/as_if) rules) if the object modified by this function is not accessed again for the rest of its lifetime (e.g., [gcc bug 8537](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=8537)). For that reason, this function cannot be used to scrub memory (e.g., to fill an array that stored a password with zeroes).

The memset call is removed from the destructor by the compiler optimization and the memory contents are not cleared.

[1] https://launchpadlibrarian.net/720237698/buildlog_ubuntu-noble-armhf.yapet_2.6-1build1_BUILDING.txt.gz [2] https://en.cppreference.com/w/cpp/string/byte/memset