Commit 0766e83d2f for qemu.org

commit 0766e83d2f94285338e6c642b4b003ffafb142f4
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Thu Jul 23 10:45:06 2026 +0100

    docs/system/security: exclude uninitialized stack variables as bugs

    The -ftrivial-auto-var-init=zero usage guarantees implicit zero
    initializers for all stack variables. Thus most bug reports relying
    on undefined behaviour from lack of variable initialization will
    not be security issues, or even bugs.

    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/docs/system/security.rst b/docs/system/security.rst
index af626a4230..8c42d1a6d8 100644
--- a/docs/system/security.rst
+++ b/docs/system/security.rst
@@ -143,6 +143,16 @@ an issue as a normal bug.
   which case plain manipulation of the stream is not considered as
   an attack vector.

+* **uninitialized stack variables**. If the bug scenario relies on
+  undefined behaviour from stack variables that lack explicit
+  initialization, it will not usually be considered a security flaw.
+  The build system adds '-ftrivial-auto-var-init=zero', which is
+  available in both the supported compilers (GCC and CLang) and
+  ensures all stack variables have implicit zero-initializers.
+  This eliminates undefined behaviour and usually gives the
+  correct desired initialization value, eliminating most of the
+  bug scenarios wrt uninitialized stack variables.
+
 * **low severity impact**. As a catch all rule, issues which
   are judged to have a "low" severity impact on the system will
   usually not justify handling as security bugs, nor assignment