FeatureRequest: Add opt-in possibility to zeroed-out buffers

[lklein53]

Hi together,

Would it be possible to extend the RecyclableMemoryStreamManager by a configuration option to zero-out buffers before returning them to the pool?
I understand that for performance reasons, the buffers are not ever pre-initialized or zeroed-out by default, but i think it would be nice to have the option to configure it if one is willing to take the performance hit.

I could create a PR for this if you think it would be a useful addition.

Best regards,
Lars

[benmwatson]

I'm not opposed to this. Go for it.

[benmwatson]

What about adding API to zero out the stream, so the caller is responsible. That would avoid having to add an if check that most people don't need.

[grbell-ms]

Do you want to add zeroing to prevent accidental data leaks or so that new streams only contain zeros? In the latter case, note that new blocks are allocated using GC.AllocateUninitializedArray which can return arrays with non-zero content.

[lklein53]

I want to add zeroing to prevent accidental data leaks.

[lklein53]

What about adding API to zero out the stream, so the caller is responsible. That would avoid having to add an if check that most people don't need.

With the API approach one would have the risk of accidental data leak in case the caller forgets to explicitly zero out memory. Also the combination with `AggressiveBufferReturn`` seems tricky.
I see the point of not adding an if check that most people don't need.
Not sure how to proceed as i think the API approach is already possible by wrapping the stream and calling

CryptographicOperations.ZeroMemory(wrappedStream.GetBuffer());

[grbell-ms]

Calling GetBuffer() won't return the encapsulated buffers if there are more than one. Do something like this instead:

var buffers = someStream.GetReadOnlySequence();
foreach (var buffer in buffers)
{
    CryptographicOperations.ZeroMemory(buffer.Span);
}

[lklein53]

This won't work as the buffers are read-only. buffer.Span will return a ReadOnlySpan

[grbell-ms]

D'oh, you're right. It'd have to be something like this:

var buffers = someStream.GetReadOnlySequence();
foreach (var buffer in buffers)
{
    ref var bytes = ref MemoryMarshal.GetReference(buffer.Span);
    var span = MemoryMarshal.CreateSpan(ref bytes, buffer.Length);
    CryptographicOperations.ZeroMemory(span);
}

But that still won't handle the large buffer if GetBuffer() was ever called during the lifetime of the stream.

[lklein53]

Would it be okay then to zero out the buffers (only if configured) before returning them to the pool ?
This would require an additional if check

[benmwatson]

Would it be okay then to zero out the buffers (only if configured) before returning them to the pool ? This would require an additional if check

I think this fine. Let's make this a 3.0 feature.