Messages in this thread | | | From | "Uecker, Martin" <> | Subject | Re: VLAs and security | Date | Tue, 4 Sep 2018 18:22:18 +0000 |
| |
Am Dienstag, den 04.09.2018, 10:00 +0200 schrieb Dmitry Vyukov: > On Tue, Sep 4, 2018 at 8:27 AM, Uecker, Martin > <Martin.Uecker@med.uni-goettingen.de> wrote: > > Am Montag, den 03.09.2018, 14:28 -0700 schrieb Linus Torvalds:
Hi Dmitry,
> Compiler and KASAN should still be able to do checking against the > static array size.
...and it is probably true that this is currently more useful than the limited amount of checking compilers can do for VLAs.
> If you mean that there is some smaller dynamic logical bound n (<N) > and we are not supposed to use memory beyond that,
Yes, this is what I mean.
My concern is that this dynamic bound is valuable information which was put there by programmers by hand and I believe that this information can not always be recovered automatically by static analysis. So by removing VLAs from the source tree, this information ist lost.
> then KMSAN [1] can > detect uses of the uninitialized part of the array. So we have some > coverage on the checking side too. > > [1] https://github.com/google/kmsan#kmsan-kernelmemorysanitizer
But detecting reads of uninitialized parts can detect only some of the errors which could be detected with precise bounds. It can not detect out-of-bounds writes (which still fall into the larger fixed-size array) and it does not detect out-of-bounds reads (which still fall into the larger fixed-size array) if the larger fixed-size array was completely initialized before for some reason.
Martin
| |