Life after free?

[Conor P. Cahill]

In article <623 at demott.COM> kdq at demott.COM (Kevin D. Quitt) writes:
>
>    It should be noted that in secure systems, free() will clear the memory.

There is no requirement for this.  The only requirement is that memory that 
is made available to a process must have no information left in it
from the previous process that used that memory. 

Since free() does not release memory to the system on most implementations,
it doesn't matter what it does (from an object reuse point of view) since 
the only process that has access to it is the one that wrote the data there.

Even if free() did release the memory to the OS, as long as the object
reuse policy of the OS cleared the free'd pages prior to allocating them
to a new process it would meet secure system requirements.
-- 
Conor P. Cahill            (703)430-9247        Virtual Technologies, Inc.,
uunet!virtech!cpcahil                           46030 Manekin Plaza, Suite 160
                                                Sterling, VA 22170