Messages in this thread | | | From | "Uecker, Martin" <> | Subject | VLAs and security | Date | Sun, 2 Sep 2018 08:08:20 +0000 |
| |
I do not agree that VLAs are generally bad for security. I think the opposite is true. A VLA with the right size allows the compiler to automatically perform or insert meaningful bounds checks, while a fixed upper bound does not.
For example:
char buf[N]; buf[n] = 1;
Here, a compiler / analysis tool can for n < N using static analysis or insert a run-time check.
Replacing this with
char buf[MAX_SIZE]
hides the information about the true upper bound from automatic tools.
Limiting the stack usage can also be achieved in the following way:
assert(N <= MAX_SIZE) char buf[N];
Of course, having predictable stack usage might be more important in the kernel and might be a good argument to still prefer the constant bound.
But loosing the tighter bounds is clearly a disadvantage with respect to security that one should keep it mind.
Best, Martin
| |