oss-sec mailing list archives

Re: SEGV in `alloca(BIG)` and `long pl[BIG]`


From: Florian Weimer <fweimer () redhat com>
Date: Wed, 08 Feb 2023 10:42:19 +0100

* Georgi Guninski:

Inline are two C warez, which crash on
`alloca(BIG)` and `long pl[BIG]`.

I think alloca(BIG) should return error if BIG>max_signed_size_t.
In C++ `new[BUG]` throws exception and core dumps.

Unfortunately, alloca cannot report an error, and there is no portable
way to discover stack boundaries anyway.  With -fstack-clash-protection,
we could reliably produce crashes, but the feature is somewhat
incomplete:

  Integer overflows in dynamically-sized stack allocations with
  -fstack-clash-protection
  <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83697>

Thanks,
Florian


Current thread: