Bug report
Bug description:
| #if defined(__STDC_NO_VLA__) && (__STDC_NO_VLA__ == 1) | |
| /* Use alloca() for VLAs. */ | |
| # define VLA(type, name, size) type *name = alloca(size) | |
| #elif !defined(__STDC_NO_VLA__) || (__STDC_NO_VLA__ == 0) | |
| /* Use actual C VLAs.*/ | |
| # define VLA(type, name, size) type name[size] | |
| #elif defined(CAN_C_BACKTRACE) |
For the same size, VLA type[size] will allocate (sizeof(type) * size) but alloca(size) will only allocate (1 * size), which is significantly smaller than intended and will cause subsequent accesses of the allocation to be out of bounds, potentially corrupting the stack.
CPython versions tested on:
3.14
Operating systems tested on:
Linux