mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-23 01:40:23 -05:00
03e0083e3b
From an attacker's point of view, a VLA declaration is essentially a
primitive for performing arbitrary arithmetic on the stack pointer. If
the attacker can control the size of a VLA they have a very powerful
tool for causing memory corruption.
To mitigate this kind of attack, and the more general class of stack
clash vulnerabilities, C compilers insert extra code when allocating a
VLA to probe the growing stack one page at a time. If these probes hit
the stack guard page, the program will crash.
From the point of view of a C programmer, there are a few things to
consider about VLAs:
* If it is important to handle allocation failures in a controlled
manner, don't use VLAs. You can use VLAs if it is OK for
unreasonable inputs to cause an uncontrolled crash.
* If the VLA is known to be smaller than some known fixed size,
use a fixed size array and a run-time check to ensure it is large
enough. This will be more efficient than the compiler's stack
probes that need to cope with arbitrary-size VLAs.
* If the VLA might be large, allocate it on the heap. The heap
allocator can allocate multiple pages in one shot, whereas the
stack clash probes work one page at a time.
Most of the existing uses of VLAs in BIND are in test code where they
are benign, but there was one instance in `named`, in the GSS-TSIG
verification code, which has now been removed.
This commit adjusts the style guide and the C compiler flags to allow
VLAs in test code but not elsewhere.
(cherry picked from commit 599c1d2a6b)
20 lines
394 B
Makefile
20 lines
394 B
Makefile
# Hey Emacs, this is -*- makefile-automake -*- file!
|
|
# vim: filetype=automake
|
|
|
|
unit-local: check
|
|
|
|
TESTS = $(check_PROGRAMS)
|
|
|
|
LOG_COMPILER = $(builddir)/../../unit-test-driver.sh
|
|
|
|
AM_CFLAGS += \
|
|
$(TEST_CFLAGS)
|
|
|
|
AM_CPPFLAGS += \
|
|
$(CMOCKA_CFLAGS) \
|
|
-DNAMED_PLUGINDIR=\"$(libdir)/named\" \
|
|
-DSKIPPED_TEST_EXIT_CODE=77 \
|
|
-DTESTS_DIR=\"$(abs_srcdir)\"
|
|
|
|
LDADD += \
|
|
$(CMOCKA_LIBS)
|