fopen mode for buffer clearing

[Florian Weimer <fweimer at redhat dot com>]

We used to use mmap for the internal FILE * buffer.  This had the side 
effect that after fclose, the data in the buffer may not be gone from 
the system as a whole, but it will definitely not be part of the address 
space of the process anymore.  This is desirable if the stdio stream 
functions are used to process sensitive data because it reduces the risk 
of leaks.

Would it make sense to add an fopen mode flag to indicate that the 
implementation should clear the buffer (with explicit_bzero) before 
deallocating it?  This would also apply to reallocating buffers in getline.

Thanks,
Florian