why Glibc does not build with clang?

[Florian Weimer]

On 05/16/2014 02:37 PM, Will Newton wrote:

> I'm curious as to why you want to get rid of alloca?

There's no explicit checking if the stack has room for the requested 
size.  It is not always clear if the implied length check through the 
explicit guard page prevents deliberate misuse of such alloca failures 
for nefarious purposes.  So we risk having crashes (already quite bad) 
and often cannot rule out any further security impact beyond the crash 
(worse).

Same thing applies to VLAs on the stack, obviously.

GCC could provide fairly cheap instrumentation (both in terms of code 
size and execution speed) that turns alloca failures (and too-large 
VLas) into reliable crashes, but that GCC feature is currently somewhat 
broken and not usable at all.

-- 
Florian Weimer / Red Hat Product Security Team