31–40 of 257 posts
Thanks to them being yet another attack vector and funny stuff like on this post, got demoted to optional on C11. Additionally Google spent several years paying to clean up the Linux kernel from all VLA occurrences. https://www.phoronix.com/news/Linux-Kills-The-VLA
Similar to making all your computations in the expressions for default arguments in python (and/or C++) and leaving the function bodies empty. Fancy, but not that mindboggling. What may surprise people is how and when these expressions are evaluated since they differ between languages.
> What may surprise people is how and when these expressions are evaluated since they differ between languages. What could possibly be surprising about reusing the exact same object on every function call, especially when you default to an empty list, set or dict. Getting an actual empty list is as easy as defaulting to None and explicitly checking for it, so there isn't even a reason to do it any differently. /s Who…
I haven't thought about C in years - that one where author passes in a printf as a char array element and de-references it to execute it ... gives me chills. Y'all kids have fun - Im going to stick with my VM over here and call it a day. This makes even modern JS look sane by comparison. Excellent write up too.
Nit: the char array doesn’t get dereferenced at all. The entire computation happens as a side effect of computing the length of the array. This is more of a case where there’s an unexpected expression context that can be abused for fun.
Thanks to them being yet another attack vector and funny stuff like on this post, got demoted to optional on C11. Additionally Google spent several years paying to clean up the Linux kernel from all VLA occurrences. https://www.phoronix.com/news/Linux-Kills-The-VLA
>Thanks to them being yet another attack vector and funny stuff like on this post, got demoted to optional on C11. Sadly, the C committee doesn't really understand what was wrong with VLAs and a sizable group of its members wants to make them mandatory again: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2921.pdf ("Does WG14 want to make VLAs fully mandatory in C23")
Similar to making all your computations in the expressions for default arguments in python (and/or C++) and leaving the function bodies empty. Fancy, but not that mindboggling. What may surprise people is how and when these expressions are evaluated since they differ between languages.
Earlier quoted context omitted.
Nit: the char array doesn’t get dereferenced at all. The entire computation happens as a side effect of computing the length of the array. This is more of a case where there’s an unexpected expression context that can be abused for fun.
The fact the array element isn't in quotes bothers me to some degree - with or without its crazy but the fact that the compiler just accepts it as a language construct as opposed to a value makes me want to drink another beer. But again Im thinking dereferencing here - and as you said thats not the case.
This isn’t much different from writing something like this in JS:
var a = [];
a[console.log("Hello"), 1] = 42;
Earlier quoted context omitted.
>Thanks to them being yet another attack vector and funny stuff like on this post, got demoted to optional on C11. Sadly, the C committee doesn't really understand what was wrong with VLAs and a sizable group of its members wants to make them mandatory again: https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2921.pdf ("Does WG14 want to make VLAs fully mandatory in C23")
What's wrong with VLAs is their syntax. It really shouldn't use the same syntax as regular C arrays, otherwise they would be fine, maybe with a scary enough keyword. They are more generic than alloca too, alloca being scoped to the function, while VLAs being scoped to the innermost block scope that contains them.
Earlier quoted context omitted.
What's wrong with VLAs is their syntax. It really shouldn't use the same syntax as regular C arrays, otherwise they would be fine, maybe with a scary enough keyword. They are more generic than alloca too, alloca being scoped to the function, while VLAs being scoped to the innermost block scope that contains them.
Syntax, no protection against stack corruption,...
Thanks to them being yet another attack vector and funny stuff like on this post, got demoted to optional on C11. Additionally Google spent several years paying to clean up the Linux kernel from all VLA occurrences. https://www.phoronix.com/news/Linux-Kills-The-VLA
This usage of VLAs is once again mandatory for compilers to support, since C23. From Wikipedia: "Variably-modified types (but not VLAs which are automatic variables allocated on the stack) become a mandatory feature".