2 ms·
On top of your reasons (which are good ones!), there’s another good reason to avoid default zero initialization in languages like C: zero is a special value for
by woodruffw 3y ago
On top of your reasons (which are good ones!), there’s another good reason to avoid default zero initialization in languages like C: zero is a special value for all kinds of sensitive operations (like UID 0 for root).
In other words: a mitigation that initializes all values to 0 may make some uses of uninitialized variables worse than they were before.
- google234123 3y ago0 is also the most common variable value probably :p hard to tell a valid state from an invalid one
- woodruffw 3y agoYes, that's why the "uninitialized" part is important; we're talking about a mitigation that would make UB potentially easier rather than harder to exploit. Having 0 as a default initialization value in a language where doing so is well defined makes perfect sense; this is primarily an issue for C and C++ (to a lesser extent).