Out of bounds in traceback.c when alloca() is used over VLA

Bug report

Bug description:

Lines 42 to 48 in ebb150e

    
           #if defined(__STDC_NO_VLA__) && (__STDC_NO_VLA__ == 1) 
        
           /* Use alloca() for VLAs. */ 
        
           #  define VLA(type, name, size) type *name = alloca(size) 
        
           #elif !defined(__STDC_NO_VLA__) || (__STDC_NO_VLA__ == 0) 
        
           /* Use actual C VLAs.*/ 
        
           #  define VLA(type, name, size) type name[size] 
        
           #elif defined(CAN_C_BACKTRACE)

For the same size, VLA type[size] will allocate (sizeof(type) * size) but alloca(size) will only allocate (1 * size), which is significantly smaller than intended and will cause subsequent accesses of the allocation to be out of bounds, potentially corrupting the stack.

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

@fuhsnn

@fuhsnn Would you like open a PR?

pythongh-145792: Fix incorrect alloca allocation size in traceback.c

gh-145792: Fix incorrect alloca allocation size in traceback.c (#145814)

pythongh-145792: Fix incorrect alloca allocation size in traceback.c (p…

@fuhsnn

@fuhsnn: I'm curious, how did you spot this bug?

[3.14] gh-145792: Fix incorrect alloca allocation size in traceback.c (…

I was playing with disabling VLA support in slimcc (and defined __STDC_NO_VLA__ accordingly), saw test_faulthandler failing because of the change then tracked down the cause, just some nerdy fun (also found a jemalloc bug this way).

pythongh-145792: Fix incorrect alloca allocation size in traceback.c (p…

Navigation Menu

Repository navigation

Out of bounds in `traceback.c` when `alloca()` is used over VLA #145792

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	#if defined(__STDC_NO_VLA__) && (__STDC_NO_VLA__ == 1)
	/* Use alloca() for VLAs. */
	# define VLA(type, name, size) type *name = alloca(size)
	#elif !defined(__STDC_NO_VLA__) \|\| (__STDC_NO_VLA__ == 0)
	/* Use actual C VLAs.*/
	# define VLA(type, name, size) type name[size]
	#elif defined(CAN_C_BACKTRACE)

Out of bounds in traceback.c when alloca() is used over VLA #145792

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

sergey-miryanov commented on Mar 11, 2026

vstinner commented on Mar 13, 2026

fuhsnn commented on Mar 13, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

Out of bounds in `traceback.c` when `alloca()` is used over VLA #145792