3 ms·
> and people being convinced that VLAs are always bad (Stack allocated) VLAs are (almost) always bad. How do you prove absence of stack overflow in their prese
by addaon 3y ago
> and people being convinced that VLAs are always bad
(Stack allocated) VLAs are (almost) always bad. How do you prove absence of stack overflow in their presence?
- uecker 3y agoAttacker controlled sizes are always bad, this is also true for heap allocations. With stack clash protection this becomes a DOS for VLAs (same as for heap allocations). But I am not saying that VLAs are always the right choice, but in many cases they are better than the next best alternative.
- addaon 3y agoIt's not about attacker control, it's about correctness of your code. Without VLAs then static analysis of the call graph (and absence of recursion) is sufficient to prove maximum stack depth; with VLAs then much deeper analysis is needed, if it's possible at all.