It allocates on the stack which is inherently of limited size and allocations grow in the direction of the “juicy” stuff. As so often with the C library, there

It allocates on the stack which is inherently of limited size and allocations grow in the direction of the “juicy” stuff. As so often with the C library, there is little bounds checking going on either (in fact, the behavior once you overflow the stack is explicitly undefined, so who knows what the hell is going to happen) If you somehow let the user specify the amount of bytes you’re going to allocate on the stack, then that’s an exploitable issue.