[tor-bugs] #7352 [Tor]: make defensein-depth memsets work in spite of compilers

[Tor Bug Tracker & Wiki]

#7352: make defensein-depth memsets work in spite of compilers
--------------------------+-------------------------------------------------
 Reporter:  nickm_mobile  |          Owner:                    
     Type:  defect        |         Status:  new               
 Priority:  major         |      Milestone:  Tor: 0.2.4.x-final
Component:  Tor           |        Version:                    
 Keywords:  tor-relay     |         Parent:                    
   Points:                |   Actualpoints:                    
--------------------------+-------------------------------------------------
 In many places in our code, we memset things to zero before leaving a
 function or freeing memory, in an attempt to limit the damage that could
 be done by a postfacto information leak.  But it appears that compilers
 like to "helpfully" optimize these out.

 I've verified that the Llvm-gcc from the latest OSX does this; I haven't
 yet had time to check vanilla gccs yet.

 Obviously, we should fix this.  It is not a vulnerability per se, but if
 there are information leaks from memory, it could make their impact worse
 than they would be otherwise.  It seems like an 024 issue but I could be
 persuaded otherwise.

 Andrey Karpov pointed this out in a recent article, but I can't
 realistically copy links on this phone.

 Next steps: look at actual compiler output from more compilers; identify
 portable or platform-specific memset replacements that won't get optimized
 out

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/7352>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online