Zennoxa Shield
Rules / C/C++
SHIELD-CPP-012

Dangerous alloca or VLA with variable size

mediumC/C++CWE-770CVSS 6.5

What it detects

alloca with a variable size can exhaust the stack and cause overflow.

How to fix

Use heap allocation with a validated bounded size instead of alloca.

Vulnerable — Shield flags thisrow_buffer.c
#include <alloca.h>
#include <string.h>

void render_row(size_t ncols) {
    /* attacker-sized stack allocation can exhaust the stack */
    char *row = alloca(ncols);
    memset(row, ' ', ncols);
}
Fixed — scans cleanrow_buffer.c
#include <stdlib.h>
#include <string.h>

#define MAX_COLS 4096

void render_row(size_t ncols) {
    if (ncols == 0 || ncols > MAX_COLS)
        return;
    char *row = malloc(ncols);      /* bounded, heap-allocated */
    if (row == NULL)
        return;
    memset(row, ' ', ncols);
    free(row);
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CPP-012, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CPP-012: Dangerous alloca or VLA with variable size — Zennoxa Shield