...
The manner in which sensitive information can be properly cleared varies depending on the resource type and platform.
Noncompliant Code Example (free())
Dynamic memory managers are not required to clear freed memory and generally do not because of the additional runtime overhead. Furthermore, dynamic memory managers are free to reallocate this same memory. As a result, it is possible to accidentally leak sensitive information if it is not cleared before calling a function that frees dynamic memory. Programmers also cannot rely on memory being cleared during allocation (see MEM09-C. Do not assume memory allocation routines initialize memory).
...