4 ms·

With VLAs: 1. The stack-smashing pattern is simple, straightforward and sure to be used often. Other ways to smash the stack require some more "effort"... 2.

With VLAs: 1. The stack-smashing pattern is simple, straightforward and sure to be used often. Other ways to smash the stack require some more "effort"... 2. It's not just _you_ who can smash the stack. It's the fact that anyone who calls your function will smash the stack if they pass some large numeric value.

saagarjha 4y ago
They can overflow the stack. They cannot smash the stack.
- rhexs 4y ago
  Useless semantic pedantry at best, but arguable wrong as there isn't some sort of ISO standard on dumb hacking terms.
  - saagarjha 4y ago
    Overflowing the stack gives you a segfault. Smashing the stack lets hackers pop a shell on your computer. They are incredibly different. VLAs can crash your program, but they do not give attackers the ability to scribble all over the stack.
    - pjmlp 4y ago
      Unless they happen to be enjoying kernel space.
      - saagarjha 4y ago
        There is no difference.
    - bjourne 4y ago
      > Overflowing the stack gives you a segfault. Maybe. If the architecture supports protected memory and the compiler has placed an appropriately sized guard page below the stack. If it doesn't then overflowing the stack via a VLA gives you easy read and write access to any byte in program memory.
      - saagarjha 4y ago
        If your architecture does not support this then you’re at risk whenever you make a function call.
        rhexs 4y ago
        Backpedal harder!
        saagarjha 4y ago
        I’m not backpedaling. If your environment has guard pages and does probing then it protects equally well against VLAs and function calls overflowing the stack. If it has neither then both are liable to overwrite other memory. Obviously I would prefer that you have the protections, or some sort of equivalent, but they have nothing to do with VLAs.
- einpoklum 4y ago
  Fair enough; I had the mistaken idea that the two terms are interchangeable, but apparently stack smashing is only used for the attack involving the stack: https://en.wikipedia.org/wiki/Stack_buffer_overflow https://en.wikipedia.org/wiki/Stack_buffer_overflow so, pretend I said "overflow" instead of "smash" in my post.

saagarjha 4y ago

They can overflow the stack. They cannot smash the stack.

rhexs 4y ago
Useless semantic pedantry at best, but arguable wrong as there isn't some sort of ISO standard on dumb hacking terms.
- saagarjha 4y ago
  Overflowing the stack gives you a segfault. Smashing the stack lets hackers pop a shell on your computer. They are incredibly different. VLAs can crash your program, but they do not give attackers the ability to scribble all over the stack.
  - pjmlp 4y ago
    Unless they happen to be enjoying kernel space.
    - saagarjha 4y ago
      There is no difference.
  - bjourne 4y ago
    > Overflowing the stack gives you a segfault. Maybe. If the architecture supports protected memory and the compiler has placed an appropriately sized guard page below the stack. If it doesn't then overflowing the stack via a VLA gives you easy read and write access to any byte in program memory.
    - saagarjha 4y ago
      If your architecture does not support this then you’re at risk whenever you make a function call.
      - rhexs 4y ago
        Backpedal harder!
        saagarjha 4y ago
        I’m not backpedaling. If your environment has guard pages and does probing then it protects equally well against VLAs and function calls overflowing the stack. If it has neither then both are liable to overwrite other memory. Obviously I would prefer that you have the protections, or some sort of equivalent, but they have nothing to do with VLAs.
einpoklum 4y ago
Fair enough; I had the mistaken idea that the two terms are interchangeable, but apparently stack smashing is only used for the attack involving the stack: https://en.wikipedia.org/wiki/Stack_buffer_overflow https://en.wikipedia.org/wiki/Stack_buffer_overflow so, pretend I said "overflow" instead of "smash" in my post.