oss-sec mailing list archives
Re: SEGV in `alloca(BIG)` and `long pl[BIG]`
From: Florian Weimer <fweimer () redhat com>
Date: Wed, 08 Feb 2023 10:42:19 +0100
* Georgi Guninski:
Inline are two C warez, which crash on `alloca(BIG)` and `long pl[BIG]`. I think alloca(BIG) should return error if BIG>max_signed_size_t. In C++ `new[BUG]` throws exception and core dumps.
Unfortunately, alloca cannot report an error, and there is no portable way to discover stack boundaries anyway. With -fstack-clash-protection, we could reliably produce crashes, but the feature is somewhat incomplete: Integer overflows in dynamically-sized stack allocations with -fstack-clash-protection <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83697> Thanks, Florian
Current thread:
- Re: SEGV in `alloca(BIG)` and `long pl[BIG]` Florian Weimer (Feb 08)
