SecureZeroMemory和ZeroMemory的区别

最新推荐文章于 2020-05-15 10:59:58 发布

天已青色等烟雨来

最新推荐文章于 2020-05-15 10:59:58 发布

阅读量2.7k

点赞数

分类专栏： C++ VS

博客地址:blog.csdn.net/x356982611，未经允许不得转载，不得转载，不得转载

本文链接：https://blog.csdn.net/x356982611/article/details/48263005

版权

C++ 同时被 2 个专栏收录

43 篇文章 1 订阅

订阅专栏

13 篇文章 0 订阅

订阅专栏

This function is defined as the RtlSecureZeroMemory function (see WinBase.h). The implementation of RtlSecureZeroMemory is provided inline and can be used on any version of Windows (see WinNT.h.)

Use this function instead of ZeroMemory when you want to ensure that your data will be overwritten promptly, as some C++ compilers can optimize a call toZeroMemory by removing it entirely.

Many programming languages include syntax for initializing complex variables to zero. There can be differences between the results of these operations and theSecureZeroMemory function. UseSecureZeroMemory to clear a block of memory in any programming language.

The following code fragment shows an instance where it is good to useSecureZeroMemory instead ofZeroMemory.

 
   C++ 
  
    WCHAR szPassword[MAX_PATH];

// Retrieve the password
if (GetPasswordFromUser(szPassword, MAX_PATH))    
   UsePassword(szPassword);
// Clear the password from memory
SecureZeroMemory(szPassword, sizeof(szPassword));

If ZeroMemory were called in this example instead of SecureZeroMemory, the compiler could optimize the call because theszPassword buffer is not read from before it goes out of scope. The password would remain on the application stack where it could be captured in a crash dump or probed by a malicious application.

ZeroMerory调用操作可能被编译器优化掉，导致保存敏感信息的堆栈不能被清空而被恶意软件利用或dump到