Putting VLA in the stack is just an implementation choice. A conforming implementation could allocate all VLA in the heap (and freeing the memory upon scope loss), or do not even use a stack/heap system at all. In that sense, VLA are a crucial language feature to allow a RAII-style for C code. Essentially, you could replace this

    void f(int n, ...)
    {
            float *t = malloc(n * sizeof*t);
            // do stuff with t[i]
            free (t);
    }

with the following semantically equivalent code

    void f(int n, ...)
    {
            float t[n];
            // do stuff with t[i]
    }

Today, this is not a good idea for large arrays because, unfortunately, many C implementations put VLA in the stack. I hope that by keeping VLA in the standard language, future C implementations will get to favor this usage.

Notice that VLA are not more dangerous or risky than recursion. The exact same argument that you use against VLA can be used against recursion. Are you against recursive functions in C? Of course, you wouldn't traverse a long array using recursion, but if you are careful that the depth of recursion is logarithmic with the array size (e.g. as in binary search), then it is perfectly safe and reasonable to use recursion. The same thing with VLA. If you are sure that n is 2,3 or at most 4 there's no reason to avoid VLA due to stack scare, and they may make your code much simpler, clearer and better.

On the other hand, VLA are useful even if you do not use them to allocate memory. Pointers to vla can be used for many things, for example accessing a one-dimensional array (allocated by a single call to malloc) using two indices as if it was a 2d array.

VLAs are no longer in the standard since C11.

Yes they are still there are optional, which basically means that other than clang and gcc, no other C compiler is going to bother supporting them anyway.

Google has sponsored a 2 year effort to remove all VLAs from Linux kernel, that is how much love they get from the security industry.

> other than clang and gcc, no other C compiler is going to bother supporting them anyway.

I understand that you have some sort of personal grudge against VLA, but there's no need to use misinformation to further your agenda. VLA are supported by all C compilers except Microsoft's. More precisely, they are supported by gcc, clang, icc, tcc and oracle developer studio (suncc), as well as several other experimental C compilers that seem to be written for fun as a learning experience.

I understand that it makes sense to avoid some language features on an OS kernel, like VLA or recursion. For example, it would make sense to avoid types of ambiguous size such as "int". This does not mean in any way that using "int" is wrong in all cases. Many algorithms (I think about mathematical and numerical codes) are very naturally expressed using these fancier language features.

You can make a very valid case for language simplification and against VLA and other "modern" features. But your argument is less powerful if you sound ignorant of the widespread support and uses of these features.

Everyone that cares about security hates VLAs, that is why ISO acknowledged the mistake of placing them into C99 and removed them from the standard in C11.

Also why Google's Kernel Self Preservation project for Linux has sponsored the 2 year effort that it took to clean up Linux from VLA usage.

You arguments for VLA adoption are meaningless when companies like Google and Microsoft are voting with their wallets against them, and WG14 has acknowledged their mistake.

> Everyone that cares about security hates VLAs,

Love and hate are emotional considerations not really worthy in this context. I would say that everybody that sees C as a valid replacement of Fortran loves and relies on VLAs and complex types. And there's probably much more people in the world interested in numeric codes than in "security" codes.

> that is why ISO acknowledged the mistake of placing them into C99 and removed them from the standard in C11.

This is most certainly not true. First, I'm almost sure that ISO never acknowledged any mistake with VLAs. Can you point me to where ISO acknowledged that purported mistake?

More importantly, your statement is false because ISO never removed VLA from the standard. That would be untoward and very contrary to their traditions. If they really wanted to remove them they would start by first deprecating them, and they are not deprecated. They are merely an optional feature of the language, just like the "main()" function is. The standard defines different kinds of conforming implementations, and some of them include VLA. Thus it is an official part of the language.

> WG14 has acknowledged their mistake

LOL. Funny that you mention that, since WG14 has added a whole new principle (the fifteenth) to their design document to acknowledge for VLA in future interfaces: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2086.htm

Anyone that knows ISO standardese knows that when a feature moves from compulsory into optional, it is a synonum for deprecated, as compilers that haven't yet adopted the specific feature never bother to spend resources implementing it.

You should read the link contents before posting them here.

"In particular, the order of parameters in function declarations should be arranged such that the size of an array appears before the array. The purpose is to allow Variable-Length Array (VLA) notation to be used."

Notation for what?

"Application Programming Interfaces (APIs) should be self-documenting when possible."

And why is that?

"This not only makes the code's purpose clearer to human readers, but also makes static analysis easier. Any new APIs added to the Standard should take this into consideration. "

On top of that, if you bother to actually read the ongoing C2X mailings, there are no plans to bring VLAs back to life, besides adopting the syntax to describe function parameters.

Most devs that take security seriously actually take the effort to know the details of the devil that we have to deal with.

You didn’t address any of his points and your rebuttals come across as little more than frantic handwaving. Moreover, as has been pointed in this post, VLAs don’t necessarily need to have security implications since they can be implemented outside the stack. Yet you keep bringing up Google and KSPP as if they are arbiters of truth instead of corporate entities with their own agendas.

You are also spreading misinformation. VLAs being optional does not mean they have been removed from the standard as you keep claiming.

Whatever, enjoy your C99 then.

Isn't there a plan to remove them in the next C standard?

Already done in C11, they were marked optional, so any compiler that jumped from C89 to C11 (we are on the edge of C2x now), isn't required to even bother themselves with VLAs and will still achieve C11 certification (C17, C2X,...)