This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/17897] Multiple 'Dynamic Stack Allocations' in security point of view
- From: "fweimer at redhat dot com" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sourceware dot org
- Date: Thu, 29 Jan 2015 15:00:57 +0000
- Subject: [Bug libc/17897] Multiple 'Dynamic Stack Allocations' in security point of view
- Auto-submitted: auto-generated
- References: <bug-17897-131 at http dot sourceware dot org/bugzilla/>
https://sourceware.org/bugzilla/show_bug.cgi?id=17897
--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Max from comment #2)
> > Please do not file omnibus bugs like this; file one bug for each separate
> > instance where you believe the stack allocation is unbounded, unless two
> > instances are extremely closely related (variants of the same code,
> > cut-and-pasted twice, for example).
>
> ok. However, I didn't check yet how long buffer may be used in the examples
> above. Therefore, everything is in one issue.
This is unfortunately the difficult part. We treat something as a bug only if
we have evidence that the alloca is actually unbounded. (Personally, I would
just call malloc/free and ban alloca and VLAs, but that's not consensus.)
> > (Unbounded stack allocations are considered bugs whether or not they cross
> > privilege boundaries, but are only security issues where a privilege
> > boundary is plausibly crossed.)
> >
>
> a application crash cannot be considered as a possible DoS?
Sure, but you'll have to demonstrate that such crashes are possible. We have
fixed many of those as (security) bugs.
--
You are receiving this mail because:
You are on the CC list for the bug.