The reason why this is allowed is that is seemingly pointless code. After this buffer is memset'd it is never referenced again and falls out of scope. Assumin

The reason why this is allowed is that is seemingly pointless code. After this buffer is memset'd it is never referenced again and falls out of scope. Assuming that all other code behaves safe and doesn't rely on undefined behavior it is unreachable. It doesn't matter if you set it to zero or not if no one reads it. For a lot of code this is a valid assumption and a safe optimizations. Read and write calls are special since they do have side effects that can't be optimized out by a compiler. Someone please correct me if I am misunderstanding this code snippet. I am fine if a compiler makes an optimization like this for my code but I can understand why this is unacceptable for crypto.