<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<div></div>
<p dir="auto">Variable Length Arrays (VLAs) and alloca() are sometimes a very fast alternative to malloc() and are also very handy because a free() or cleanup is not needed.</p>
<p dir="auto">But VLAs and alloca() easily introduce security issues. Their use in code needs thorough care and manual review, basically with every code change that uses them directly or indirectly. It is a common vulnerability pattern that attackers gain control over the size of those stack allocations, enabling stack overflows, remote code execution, denial-of-service, and the like. Current prominent example is <a href="https://www.openwall.com/lists/oss-security/2019/01/09/3" rel="nofollow noreferrer noopener" target="_blank">https://www.openwall.com/lists/oss-security/2019/01/09/3</a>.</p>
<p dir="auto">As a security-related software project, we should not ignore such concerns. Not in the library code nor in the tools.</p>
<p dir="auto">IMO we should disallow VLAs and alloca() in our code, replace them appropriately and add an automatic check on MRs via the Gitlab CI.</p>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #777777;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/issues/684">view it on GitLab</a>.
<br>
You're receiving this email because of your account on gitlab.com.
If you'd like to receive fewer emails, you can
<a href="https://gitlab.com/sent_notifications/0e258ff4762ed69bc6963ec33247ba49/unsubscribe">unsubscribe</a>
from this thread or
adjust your notification settings.
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/issues/684"}}</script>
</p>
</div>
</body>
</html>