blow the stack with arbitrarily-extendible VLAs

[Pierre Habouzit]

On Sat, May 05, 2007 at 10:27:56PM +0200, Jim Meyering wrote:
> After seeing the recently-fixed user-extendible VLA in vfprintf.c,
> I wondered if there were others.

  FWIW, unlike printf, where the VLA array could had its size changed
because of the end user input (imagine some mod_* in apache that used
printf to display formatted output asking the user for the width of the
formatting... bang a DOS), it's quite unlikely that user input could
impact the size passed to lio_listio (or the other examples you took).

  Oh I don't say it's nice, but I'd say it's way less critical.

-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20070505/f6da6a54/attachment.sig>