I believe rurban might have some point - for example, consider this CCC talk: https://www.youtube.com/watch?v=0WzjAKABSDk https://www.youtube.com/watch?v=0WzjA

I believe rurban might have some point - for example, consider this CCC talk: https://www.youtube.com/watch?v=0WzjAKABSDk https://www.youtube.com/watch?v=0WzjAKABSDk The point is that memset is often critical for security and compilers don't always do a good job of optimizing it out. If they strike a false positive, information leak vulnerabilities are very likely. It's also pretty difficult to detect those failures without recompiling entire program with a modified compiler, as shown in the talk.