Re: A Famous Security Bug

"Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> writes:

On 3/20/2024 12:37 PM, Chris M. Thomasson wrote:

On 3/20/2024 11:18 AM, Stefan Ram wrote:

    A "famous security bug":
>
void f( void )
{ char buffer[ MAX ];
    /* . . . */
    memset( buffer, 0, sizeof( buffer )); }
>
    . Can you see what the bug is?
>
    (I have already read the answer; I post it as a pastime.)

Add in a volatile? ;^)

>
Instead of zeroing, what about filling it with random bytes reaped
from a TRNG?

 Why?