Bug report
Bug description:
|
#if defined(__STDC_NO_VLA__) && (__STDC_NO_VLA__ == 1) |
|
/* Use alloca() for VLAs. */ |
|
# define VLA(type, name, size) type *name = alloca(size) |
|
#elif !defined(__STDC_NO_VLA__) || (__STDC_NO_VLA__ == 0) |
|
/* Use actual C VLAs.*/ |
|
# define VLA(type, name, size) type name[size] |
|
#elif defined(CAN_C_BACKTRACE) |
For the same size, VLA type[size] will allocate (sizeof(type) * size) but alloca(size) will only allocate (1 * size), which is significantly smaller than intended and will cause subsequent accesses of the allocation to be out of bounds, potentially corrupting the stack.
CPython versions tested on:
3.14
Operating systems tested on:
Linux
Linked PRs
Bug report
Bug description:
cpython/Python/traceback.c
Lines 42 to 48 in ebb150e
For the same
size, VLAtype[size]will allocate(sizeof(type) * size)butalloca(size)will only allocate(1 * size), which is significantly smaller than intended and will cause subsequent accesses of the allocation to be out of bounds, potentially corrupting the stack.CPython versions tested on:
3.14
Operating systems tested on:
Linux
Linked PRs