...
| Wiki Markup |
|---|
The above statement is evaluated at runtime allocating storage for {{s{}}} characters in stack memory. If a size argument supplied to VLAs is not a positive integer value of reasonable size, then the program may behave in an unexpected way. An attacker may be able to leverage this behavior to overwrite critical program data \[[Griffiths 06|http://felinemenace.org/papers/p63-0x0e_Shifting_the_Stack_Pointer.txt]\]. The programmer must ensure that size arguments to VLAs are valid and have not been corrupted as the result of an exceptional integer condition. |
...
| Code Block |
|---|
void func(size_t s) {
int vla[s];
...
}
...
func(size);
...
|
...
| Code Block |
|---|
#define MAX_ARRAY 1024
void func(size_t s) {
int vla[s];
...
}
...
if (s < MAX_ARRAY && s != 0) {
func(s);
} else {
/* Handle Error */
}
...
|
...