5 ms·
In my opinion the improved code quality and bounds checking you can get with VLAs are worth it. Yes, the an attacker should not control the size and one should
by uecker 4y ago
In my opinion the improved code quality and bounds checking you can get with VLAs are worth it. Yes, the an attacker should not control the size and one should use -fstack-clash-protection and when the stack size is limited you should think twice (but vla can also reduce stack size if the alternative is a fixed size array on stack with larger fixed upper bound).
- fanf2 4y agoVLAs do not have extra bounds checking. Looking at it from an attacker’s point of view, a VLA is a primitive for adding an arbitrary offset to the stack pointer: extremely powerful and dangerous. You can’t use VLAs for large allocations because the stack has a limited amount of space and you don’t know what that limit is. So you must check the size is reasonable before declaring a VLA. So you might as well declare a fixed-size array that is large enough for all reasonable uses.
- uecker 4y agoVLAs can enable precise bounds checking with the undefined behavior sanitizer. This is useful and you do not have precise bounds checking anymore when you replace it with a larger fixed size array. Also you increase stack size when you replace with a larger fixed size array. Yes, one should not let an attacker control the size of the VLA. But in any case, one should use -fstack-clash-protection . With stack clash protection if an attacker can control the size of VLA and it becomes to large, you can a trap with is likely DoS. With a fixed size array which you overflow instead, it is more likely a RCE. If you check the size, it does not matter. That you can't use the stack for large allocations has nothing to with VLAs and also depends on what you call large and how large your stack is.
- pjmlp 4y agoThey were made optional in C11, while Google paid for the development effort to clean the Linux kernel of them, because they are only yet another source of possible CVEs.
- uecker 4y agoMaybe you did not realize this, but I somewhat helped with this effort. In the kernel it may make (some) sense. The overall idea that VLA are always bad is incorrect.
- pjmlp 4y agoIt is hard to link an empty profile to anything. The people at WG14, Google and Microsoft (VLAs are one of few C99 features not ever coming to MSVC) think otherwise. So you're basically saying they are wrong.
- Gibbon1 4y agoYour appeal to authority using WG14 (hapless goldbricks) and google/Microsoft (C++ shops) falls really flat.
- pjmlp 4y agoThat authority drives the C language evolution and couldn't care less about what you, or me for that matter, think.
- uecker 4y agoAnd I am part of WG14 (so a hapless goldbrick). The reason VLA were made optional to make implementing C easier, as C99 was not adopted quickly. Although the reason for the slow adoption were others. MSVC did not really support C at all at C99 time because they thought everyone should transition to C++. Only very recently C support catched up in MSVC.
- pjmlp 4y agoGreat, so when is the C11 rationale getting published? https://groups.google.com/g/comp.std.c/c/E0yxHfpcOfY https://groups.google.com/g/comp.std.c/c/E0yxHfpcOfY
- packetlost 4y agoIf you wanted to exclusively use the stack for all program memory (no heap, no `malloc`, etc.), is it possible to increase the programs stack size?
- suprjami 4y agoThe userspace stack size is controlled with `ulimit -s`.
- Jorengarenar 4y ago> VLAs do not have extra bounds checking. Actually, they allow for some limited size checking in function parameters [0], but GCC added this feature only very recently [0]: [link redacted]
- uecker 4y agoNot only this, but also out of bounds accesses using UBSan: https://godbolt.org/z/q9qsax7qY https://godbolt.org/z/q9qsax7qY (also compiler support is still improving)
- Jorengarenar 4y agoI'm not sure about this example. It basically shows that if you use automatic VLA you have can do some checks on VLA. But if I prohibit automatic VLA altogether and use fixed size array, I don't need to worry about that at all and the example falls back to what I presented with UBSan doing just its regular thing.
- uecker 4y agoIf you have larger fixed size array you can get an error when you overflow the larger array. But this then does not necessarily prevent invalid accesses to the parts of the array which go beyond the actual size of what is stored in it or might not prevent bound overflows when copying from the array to some other place.