Password theft from memory?

[Bob Hall]

On Mon, Apr 25, 2011 at 03:18:46PM +0100, RW wrote:
> I don't believe the heap is allocated zeroed pages.  The kernel
> does allocate such pages to the BSS segment, but that's because it
> holds zeroed data such as C static variables.

According to McKusick and Neville-Neil's book on FreeBSD, sbrk extends
the uninitialized data segment with zero-filled pages. Since malloc() is
an interface to sbrk, it does the same thing.