Home/ Questions/Q 551719
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T11:25:25+00:00

This MSND article says SecureZeroMemory() is good for cases when sensitive data stored in

  • 0

This MSND article says SecureZeroMemory() is good for cases when sensitive data stored in memory for a while should be for sure overwritten as soon as possible when no longer needed. Answers to this SO question explain why this can make a difference.

Now is there any sence in using SecureZeroMemory() for initializing just every memory block? For example in one project I see code like the following:

ICONINFO ii; 
::SecureZeroMemory(&ii, sizeof(ICONINFO)); 
if (::GetIconInfo(hIcon, &ii)) 
{
    //do stuff, then 
    //release bitmaps 
    if(ii.hbmMask) 
        ::DeleteObject(ii.hbmMask); 
    if(ii.hbmColor) 
        ::DeleteObject(ii.hbmColor); 
}

why use SecureZeroMemory() here instead of ZeroMemory(), memset() or value initialization? I mean if the compiler decides initialization is unnecessary and wants to optimize it out – why would I enforce it? Is there any reason to use SecureZeroMemory() here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It makes no sense to use SecureZeroMemory to initialize an icon info structure. It can only overwrite bytes on the stack frame that should have been securely erased elsewhere. That horse already escaped the barn. It doesn’t even make sense to initialize it at all, the return value of GetIconInfo() tells you that it got initialized.

    SecureZeroMemory() only makes sense after memory was filled with secure data.

    • 0