Re: blow the stack with arbitrarily-extendible VLAs

[Pierre Habouzit <madcoder at debian dot org>]

On Sat, May 05, 2007 at 10:27:56PM +0200, Jim Meyering wrote:
> After seeing the recently-fixed user-extendible VLA in vfprintf.c,
> I wondered if there were others.

  FWIW, unlike printf, where the VLA array could had its size changed
because of the end user input (imagine some mod_* in apache that used
printf to display formatted output asking the user for the width of the
formatting... bang a DOS), it's quite unlikely that user input could
impact the size passed to lio_listio (or the other examples you took).

  Oh I don't say it's nice, but I'd say it's way less critical.

-- 
ÂOÂ  Pierre Habouzit
ÂÂO                                                madcoder@debian.org
OOO                                                http://www.madism.org

Attachment: pgp00000.pgp
Description: PGP signature