[sairedis] Replace memset functions

[maipbui]

Signed-off-by: maipbui [email protected]

Why I did it memset() is an insecure function that can cause buffer overflow. memset() may not be called by the compiler. Due to compiler optimization: an optimizing compiler, which identifies and removes the function that overwrites the contents as a dead store because the memory is not used subsequently. If sensitive data is in memory, it's dangerous if compiler optimization happens. Ref: https://cwe.mitre.org/data/definitions/14.html https://registry.semgrep.dev/rule/c.lang.security.insecure-use-memset.insecure-use-memset

How I did it Remove memset(), initialize the variable to 0.

[kcudnik]

can we use memset_s in all places instead doing ifdef ?

[maipbui]

can we use memset_s in all places instead doing ifdef ?

I don't think so, seems like gcc/g++ doesn't support memset_s

[maipbui]

/AzurePipelines run Azure.sonic-sairedis

[azure-pipelines[bot]]

Azure Pipelines successfully started running 1 pipeline(s).

[qiluo-msft]

@kcudnik Could you review again?

[kcudnik]

please satisfy code coverage: https://dev.azure.com/mssonic/build/_build/results?buildId=147452&view=codecoverage-tab in unittests

[kcudnik]

i added some unittest to cover old code https://github.com/sonic-net/sonic-sairedis/pull/1133