Do not use alloca inside a loop #21

Merged

ryanlerch merged 1 commit from alloca-loops into master

2022-02-11 12:34:45 +00:00

ret2libc commented

2022-01-31 11:59:11 +00:00

Contributor

No description provided.

fweimer commented

2022-01-31 13:25:58 +00:00

First-time contributor

The advise is good, but alloca memory can be deallocated on scope exit if the scope contains a VLA. I don't think compilers diagnose this properly.

The advise is good, but `alloca` memory can be deallocated on scope exit if the scope contains a VLA. I don't think compilers diagnose this properly.

ret2libc commented

2022-01-31 13:39:43 +00:00

Author

Contributor

From the man page it says:

The  alloca() function allocates size bytes of space in the stack frame of the caller.  This temporary space is automatically freed when the function that called alloca() returns to its caller.

If it is deallocated on scope exit it goes against the description, doesn't it?

From the man page it says: ``` The alloca() function allocates size bytes of space in the stack frame of the caller. This temporary space is automatically freed when the function that called alloca() returns to its caller. ``` If it is deallocated on scope exit it goes against the description, doesn't it?

fweimer commented

2022-01-31 13:56:00 +00:00

First-time contributor

Huh, it turns out I misremembered, and according to the GCC documentation, calling alloca inhibits VLA deallocation, not the other way round:

The space for a variable-length array is deallocated as soon as the array name’s scope ends, unless you also use alloca in this scope.

https://gcc.gnu.org/onlinedocs/gcc/Variable-Length.html

A short test program confirms this:

#include <alloca.h>

void f1 (int *, int *);

void f2 (int n)
{
  for (int i = 0; i < n; ++i)
    {
      int a[n];
      int *b = alloca (sizeof (*b) * n);
      f1 (a, b);
    }
}

Huh, it turns out I misremembered, and according to the GCC documentation, calling `alloca` inhibits VLA deallocation, not the other way round: > The space for a variable-length array is deallocated as soon as the array name’s scope ends, unless you also use `alloca` in this scope. https://gcc.gnu.org/onlinedocs/gcc/Variable-Length.html A short test program confirms this: ```c #include <alloca.h> void f1 (int *, int *); void f2 (int n) { for (int i = 0; i < n; ++i) { int a[n]; int *b = alloca (sizeof (*b) * n); f1 (a, b); } } ```