Hacker News Reader

Does it (buffer bleeds) happen on languages that systematically zeroe their memory? (I vaguely remember reading that for Java but I'm not sure)

View on HN

Yes, although as s_gourichon said, if there's any object pool reuse of these buffers then the potential for bleeds comes back.

So, for example, you could still have a bleed in Node.js, even if you're safely allocating them as zeroed, but you're then reusing them, say when you're writing something to a file and then shipping it off elsewhere.

If you are reusing things beware that languages will sometimes optimize out attempts to zero memory when they notice you write something else after that, or free it. Check your compiler/implementation instructions for details, if they don't give specific guidance assume that even if they do the right thing now the next upgrade will do differently.

Thanks, good catch!

That fixes the problem of a buffer content after allocation by the language/runtime/platform. When a buffer is reused at the library/application level, no zeroing is done.

Reply on news.ycombinator.com