Re: [PATCH] docs/system/security: exclude uninitialized stack variables as bugs

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Jul 23, 2026 at 01:59:30PM +0400, Marc-André Lureau wrote:
> On Thu, Jul 23, 2026 at 1:46 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
> >
> > The -ftrivial-auto-var-init=zero usage guarantees implicit zero
> > initializers for all stack variables. Thus most bug reports relying
> > on undefined behaviour from lack of variable initialization will
> > not be security issues, or even bugs.
> >
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> 
> Still worth to explicitly clear or set the variable though, since it's
> not standard C otherwise and sometimes 0 is not the correct value.

Yes, certainly we should make it explicit for reviewer sanity
if nothing else.


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|