GnuTLS and zeroing keys in Emacs

[Paul Eggert]

Thanks for your recent GnuTLS-related contributions for Emacs. I found 
some minor glitches with respect to integer overflow detection and 
style, and installed the attached patch to try to help clear up the 
problems I found.

I did notice one other thing: sometimes the new code zeros out keys that 
will be garbage, I guess under the theory that this will help protect 
the user from hostile code within Emacs that attempts to steal keys by 
reading "unused" memory. However, zeroing out these keys does not 
actually destroy the keys reliably, as some compilers elide code that 
clears about-to-become-garbage objects, and some of the strings may be 
moved in garbage-collected memory (so their old contents are not zeroed).

I left in the code that clears keys, but I'm wondering: is there some 
general Emacs-internal guideline about this sort of thing? If we're 
serious about clearing keys I suppose we need to tell the GC and 
compilers not to move them around or optimize away useless stores. If 
not, then perhaps we should mark the key-clearing code in some way that 
says "this doesn't work in general but is the best we can easily do".

0001-GnuTLS-integer-overflow-and-style-fixes.patch
Description: Text Data