title: Local variable length array
body: <p>during some code refactor in C++ i meet following local variable length arrays</p>
  
  <pre><code>void some_function(uint8_t length, uint8_t id, uint8_t * bytes)) {
      uint8_t string[length + 8];
      //some transformation on string [1-8] elements
  
      do_something(string);
  }
  </code></pre>
  
  <p>I am not familiar with C99 but using Variable-length array size [x+y] look like this will be placed in heap. Also I debug this function to make sure that this "string" variable is placed on heap and it is.
  In C local variables can't be fixed size, so they are not needed to clean up after using them. But here we have fixed size array without memory allocation, so is no need to clean up after this variable, but how GCC compiler manage this memory?</p>
  
  <p>Or maybe on other way to clarifying what I am considering here: length variable is coming from external IO so in my opinion there can be security issue (for example when length will be INTEGER_MAX value), besides check the size of length what other actions can be taken to have secure code here? Or maybe it is already secure?</p>