How is the stack initialized?

Question

When a process requests for memory and an operating system is giving some new pages to the process, the kernel should initialize the pages (with zeros for instance) in order to avoid showing potentially confident data that another process used. The same when a process is starting and receives some memory, for example the stack segment.

When I execute the following code in Linux, the result is that the majority of allocated memory is indeed 0, but something about 3-4 kB at the bottom of the stack (the last elements of the array, the highest addresses) contains random numbers.

#include <cstdlib>
#include <iostream>
using namespace std;

int main()
{
    int * a = (int*)alloca(sizeof(int)*2000000);
    for(int i = 0; i< 2000000; ++i)
        cout << a[i] << endl;
    return 0;
}

1. Why isn't it set to zero too?
2. Could it be because it is being reused by the process?
3. If yes, could it be the initialization code that had used those 3-4 kB of memory earlier?

Answer 1

The operating system does not guarantee a zero'ed out memory, just that you own it. It will probably give you pages of memory that were used before (or never used before, but non-zero). If an application stores potentially-sensitive data, it is expected to zero it before free()'ing.

It's not set to zero because that would be performing unnecessary work. If you allocate 20 megabytes to store a texture or a few frames of video, why would the OS write zeroes to all that memory just so you can overwrite them as the very next thing you do.

As a general rule, operating systems don't do anything that they don't have to.

edit: to expand a little bit, when you "allocate" a block of memory, all the OS is doing is re-assigning pages of memory (blocks of 4096 bytes, typically) to your process from a pool of un-allocated pages. You can also have shared memory, in which case the OS 'assigns' them to multiple processes. That's all allocation amounts to.

Answer 2

When you get new memory into your process through brk(), sbrk() or mmap() then it is guaranteed to be zeroed out.

But the process stack is already allocated to your process. The alloca() function does not get new stack space, it just returns the current stack pointer and moves the pointer to the end of the new block.

So the memory block returned by alloca() has been previously used by your process. Even if you don't have functions before your alloca() in main, the C libraries and dynamic loader have been using the stack.