11 ms·
What's wrong with VLAs is their syntax. It really shouldn't use the same syntax as regular C arrays, otherwise they would be fine, maybe with a scary enough key
by planede 4y ago
What's wrong with VLAs is their syntax. It really shouldn't use the same syntax as regular C arrays, otherwise they would be fine, maybe with a scary enough keyword. They are more generic than alloca too, alloca being scoped to the function, while VLAs being scoped to the innermost block scope that contains them.
- pjmlp 4y agoSyntax, no protection against stack corruption,...
- planede 4y agoYou can corrupt the stack without VLAs just fine. What else?
- pjmlp 4y agoWhat about not adding even more ways how we should avoid using C?
- arinlen 4y ago> What about not adding even more ways how we should avoid using C? That's a mute point for C's target audience because they already understand that they need to be mindful of what the language does.
- pjmlp 4y agoThat is like saying if sushi knifes are already sharp enough, there is no issue cutting fish with a samurai sword instead, except at least with the knife maybe the damage isn't as bad.
- Koshkin 4y agoI like your comparison of a C programmer with a samurai.
- pjmlp 4y agoIncluding that most of them end up doing Seppuku on their applications.
- agumonkey 4y agowhile we're hugging them from behind
- phibz 4y agoIt's more like the C programmer is a sushi master. They can make a delicious, beautifully crafted snack. But if the wrong ingredients are used you'll get very sick.
- samatman 4y agoThe difference between the largest sushi knives and a katana is more about who wields them than the blade involved.
- arinlen 4y ago> That is like saying if sushi knifes are already sharp enough (...) No, it's like saying that professional people understand the need to learn what their tools of the trade do beyond random stackoverflow search on how to print text to stdout. It seems you have an irrational dislike of C. That's perfectly ok. No need to come up with excuses though.
- pjmlp 4y agoIt doesn't seem, I do. Ever since I got my hands on Turbo C++ 1.0, back in 1993, I see no reason why one should downgrade ourselves to C. At least C++ give us the tools to be a bit more secure, even if tainted with C's copy-paste compatibility. You will find posts from me on Usenet, stading on C++ frontline of C vs C++ flamewars. No one is making excuses, it should be nuked, unfortunely it will outlive all of us.
- mjcohen 4y agoWhat the heck. It's "moot", not "mute".
- wizofaus 4y agoI'm curious, are there accents in which those two words are homophones? Given the US tendency to pronounce new/due/tune as noo/doo/toon I can imagine some might say mute as moot but I can't find anything authoritative online.
- danuker 4y agoThey are not perfect homophones. There is a slight i (IPA j) in "mute". https://en.wiktionary.org/wiki/mute https://en.wiktionary.org/wiki/mute https://en.wiktionary.org/wiki/moot https://en.wiktionary.org/wiki/moot
- jcranmer 4y agoAccording to Wikipedia, East Anglia does universal yod-dropping, so mute/moot would be homophonic. (See https://en.wiktionary.org/wiki/Appendix:English_dialect-dependent_homophones#Yod-dropping_and_coalescence https://en.wiktionary.org/wiki/Appendix:English_dialect-depe...). Personally, I haven't come across anyone who pronounces 'mute' without the /j/.
- einpoklum 4y agoWith VLAs: 1. The stack-smashing pattern is simple, straightforward and sure to be used often. Other ways to smash the stack require some more "effort"... 2. It's not just _you_ who can smash the stack. It's the fact that anyone who calls your function will smash the stack if they pass some large numeric value.
- saagarjha 4y agoThey can overflow the stack. They cannot smash the stack.
- rhexs 4y agoUseless semantic pedantry at best, but arguable wrong as there isn't some sort of ISO standard on dumb hacking terms.
- saagarjha 4y agoOverflowing the stack gives you a segfault. Smashing the stack lets hackers pop a shell on your computer. They are incredibly different. VLAs can crash your program, but they do not give attackers the ability to scribble all over the stack.
- pjmlp 4y agoUnless they happen to be enjoying kernel space.
- saagarjha 4y agoThere is no difference.
- bjourne 4y ago> Overflowing the stack gives you a segfault. Maybe. If the architecture supports protected memory and the compiler has placed an appropriately sized guard page below the stack. If it doesn't then overflowing the stack via a VLA gives you easy read and write access to any byte in program memory.
- rwmj 4y agoVLAs make it a lot easier to corrupt the stack by accident. Unless you're quite a careful coder, stuff like: f (size_t n) { char str[n]; leads to a possible exploit where the input is manipulated so n is large, causing a DoS attack (at best) or full exploit at worse. I'm not saying that banning VLAs solves every problem though. However the main reason we forbid VLAs in all our code is because thread stacks (particularly on 32 bit or in kernel) are quite limited in depth and so you want to be careful with stack frame size. VLAs make it harder to compute and thus check stack frame sizes at compile time, making the -Wstack-usage warning less effective. Large arrays get allocated on the heap instead.
- chjj 4y agoYou shouldn't be writing C if you're not a careful coder.
- samatman 4y agoAnd if you're a careful coder writing C, you should give the VLA the stink eye unless it's proving its worth.
- pjmlp 4y agoYeah, right. https://msrc-blog.microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/ https://msrc-blog.microsoft.com/2019/07/16/a-proactive-appro... https://research.google/pubs/pub46800/ https://research.google/pubs/pub46800/ https://support.apple.com/guide/security/memory-safe-iboot-implementation-sec30d8d9ec1/web https://support.apple.com/guide/security/memory-safe-iboot-i... Maybe you could give an helping hand to Microsoft, Apple and Google, they are in need of carefull C coders.
- chjj 4y agoI'm not sure if you intentionally missed my point. Everything in C requires careful usage. VLAs aren't special: they're just yet another feature which must be used carefully, if used at all. Personally, I don't use them, but I don't find "they're unsafe" to be a convincing reason for why they shouldn't be included in the already-unsafe language. Saying they're unnecessary might be a better reason.
- saagarjha 4y agoVLAs are no more unsafe than standard C is for stack corruption.
- tstanisl 4y agoint A[100000000]; Also has no protection.