Re: Issue building gnulib with clang (as used in GRUB)

[Paul Eggert]

On 3/24/22 12:16, Darren Kenny wrote:
> Is this a known issue when building with clang? Would you have any
> suggestions on how to correctly resolve it?

I didn't know about the issue, or had forgotten about it.

One way to resolve it would be to figure out what clang option is needed 
to suppress the incorrect warning, and to submit a patch to Gnulib that 
will use that option. If clang spells it differently from -Wvla, then 
use the different spelling.

> I've tried building with the C flag -D__STDC_NO_VLA__, and this will get
> it to build, but that seems like something that should only be defined
> by a compiler and not a consumer of the gnulib code.

Another possibility is to ask the clang folks, perhaps by filing a bug 
report, as to why their compiler is rejecting VLAs but is not defining 
__STDC_NO_VLA__. A compiler is supposed to define that macro if it's not 
supporting VLAs.

> he possible
> security issue is that this size variable can be manipulated
> to enable mis-use via a stack overflow
That issue shouldn't happen here; i.e., the diagnostic is a false alarm.