[Bug libc/17897] Multiple 'Dynamic Stack Allocations' in security point of view

["fweimer at redhat dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=17897

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Max from comment #2)
> > Please do not file omnibus bugs like this; file one bug for each separate 
> > instance where you believe the stack allocation is unbounded, unless two 
> > instances are extremely closely related (variants of the same code, 
> > cut-and-pasted twice, for example).
> 
> ok. However, I didn't check yet how long buffer may be used in the examples
> above. Therefore, everything is in one issue.

This is unfortunately the difficult part.  We treat something as a bug only if
we have evidence that the alloca is actually unbounded.  (Personally, I would
just call malloc/free and ban alloca and VLAs, but that's not consensus.)

> > (Unbounded stack allocations are considered bugs whether or not they cross 
> > privilege boundaries, but are only security issues where a privilege 
> > boundary is plausibly crossed.)
> > 
> 
> a application crash cannot be considered as a possible DoS?

Sure, but you'll have to demonstrate that such crashes are possible.  We have
fixed many of those as (security) bugs.

-- 
You are receiving this mail because:
You are on the CC list for the bug.