33 files changed, 224 insertions, 170 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index bf3cc06a..244c13d1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -197,6 +197,7 @@ set(toxcore_PKGCONFIG_LIBS)
 apidsl(
   toxcore/crypto_core.api.h)
 add_module(toxcrypto
+  toxcore/ccompat.h
   toxcore/crypto_core.c
   toxcore/crypto_core.h
   toxcore/crypto_core_mem.c)
diff --git a/appveyor.yml b/appveyor.yml
index 879ebc10..5add5f31 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -3,7 +3,7 @@ install:
 - unzip libsodium-1.0.11-msvc.zip
 
 before_build:
-- cmake . -DBOOTSTRAP_DAEMON=OFF
+- cmake . -DBOOTSTRAP_DAEMON=OFF -DENABLE_SHARED=OFF
 
 build:
   project: INSTALL.vcxproj
diff --git a/auto_tests/TCP_test.c b/auto_tests/TCP_test.c
index a1de4874..a5a70c4b 100644
--- a/auto_tests/TCP_test.c
+++ b/auto_tests/TCP_test.c
@@ -188,19 +188,19 @@ static void kill_TCP_con(struct sec_TCP_con *con)
 
 static int write_packet_TCP_secure_connection(struct sec_TCP_con *con, uint8_t *data, uint16_t length)
 {
-    uint8_t packet[sizeof(uint16_t) + length + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, packet, sizeof(uint16_t) + length + CRYPTO_MAC_SIZE);
 
     uint16_t c_length = htons(length + CRYPTO_MAC_SIZE);
     memcpy(packet, &c_length, sizeof(uint16_t));
     int len = encrypt_data_symmetric(con->shared_key, con->sent_nonce, data, length, packet + sizeof(uint16_t));
 
-    if ((unsigned int)len != (sizeof(packet) - sizeof(uint16_t))) {
+    if ((unsigned int)len != (SIZEOF_VLA(packet) - sizeof(uint16_t))) {
         return -1;
     }
 
     increment_nonce(con->sent_nonce);
 
-    ck_assert_msg(send(con->sock, (const char *)packet, sizeof(packet), 0) == sizeof(packet), "send failed");
+    ck_assert_msg(send(con->sock, (const char *)packet, SIZEOF_VLA(packet), 0) == SIZEOF_VLA(packet), "send failed");
     return 0;
 }
 
diff --git a/auto_tests/encryptsave_test.c b/auto_tests/encryptsave_test.c
index 22c585ed..749767a0 100644
--- a/auto_tests/encryptsave_test.c
+++ b/auto_tests/encryptsave_test.c
@@ -13,6 +13,7 @@
 
 #include "../toxcore/tox.h"
 
+#include "../toxcore/ccompat.h"
 #include "../toxcore/crypto_core.h"
 #include "../toxencryptsave/toxencryptsave.h"
 #ifdef VANILLA_NACL
@@ -68,10 +69,10 @@ START_TEST(test_save_friend)
     ck_assert_msg(test != UINT32_MAX, "Failed to add friend");
 
     size_t size = tox_get_savedata_size(tox1);
-    uint8_t data[size];
+    VLA(uint8_t, data, size);
     tox_get_savedata(tox1, data);
     size_t size2 = size + TOX_PASS_ENCRYPTION_EXTRA_LENGTH;
-    uint8_t enc_data[size2];
+    VLA(uint8_t, enc_data, size2);
     TOX_ERR_ENCRYPTION error1;
     bool ret = tox_pass_encrypt(data, size, (const uint8_t *)"correcthorsebatterystaple", 25, enc_data, &error1);
     ck_assert_msg(ret, "failed to encrypted save: %u", error1);
@@ -86,7 +87,7 @@ START_TEST(test_save_friend)
     ck_assert_msg(err2 == TOX_ERR_NEW_LOAD_ENCRYPTED, "wrong error! %u. should fail with %u", err2,
                   TOX_ERR_NEW_LOAD_ENCRYPTED);
     ck_assert_msg(tox3 == NULL, "tox_new with error should return NULL");
-    uint8_t dec_data[size];
+    VLA(uint8_t, dec_data, size);
     TOX_ERR_DECRYPTION err3;
     ret = tox_pass_decrypt(enc_data, size2, (const uint8_t *)"correcthorsebatterystaple", 25, dec_data, &err3);
     ck_assert_msg(ret, "failed to decrypt save: %u", err3);
@@ -99,19 +100,20 @@ START_TEST(test_save_friend)
     ck_assert_msg(memcmp(address, address2, TOX_PUBLIC_KEY_SIZE) == 0, "addresses don't match!");
 
     size = tox_get_savedata_size(tox3);
-    uint8_t data2[size];
+    VLA(uint8_t, data2, size);
     tox_get_savedata(tox3, data2);
     Tox_Pass_Key *key = tox_pass_key_new();
     ck_assert_msg(key != NULL, "pass key allocation failure");
     memcpy((uint8_t *)key, test_salt, TOX_PASS_SALT_LENGTH);
     memcpy((uint8_t *)key + TOX_PASS_SALT_LENGTH, known_key2, TOX_PASS_KEY_LENGTH);
     size2 = size + TOX_PASS_ENCRYPTION_EXTRA_LENGTH;
-    uint8_t encdata2[size2];
+    VLA(uint8_t, encdata2, size2);
     ret = tox_pass_key_encrypt(key, data2, size, encdata2, &error1);
     ck_assert_msg(ret, "failed to key encrypt %u", error1);
     ck_assert_msg(tox_is_data_encrypted(encdata2), "magic number the second missing");
 
-    uint8_t out1[size], out2[size];
+    VLA(uint8_t, out1, size);
+    VLA(uint8_t, out2, size);
     ret = tox_pass_decrypt(encdata2, size2, (const uint8_t *)pw, pwlen, out1, &err3);
     ck_assert_msg(ret, "failed to pw decrypt %u", err3);
     ret = tox_pass_key_decrypt(key, encdata2, size2, out2, &err3);
diff --git a/auto_tests/messenger_test.c b/auto_tests/messenger_test.c
index efe2963a..bd524014 100644
--- a/auto_tests/messenger_test.c
+++ b/auto_tests/messenger_test.c
@@ -184,7 +184,7 @@ START_TEST(test_getself_name)
 {
     const char *nickname = "testGallop";
     int len = strlen(nickname);
-    char nick_check[len];
+    VLA(char, nick_check, len);
 
     setname(m, (const uint8_t *)nickname, len);
     getself_name(m, (uint8_t *)nick_check);
@@ -237,7 +237,7 @@ START_TEST(test_dht_state_saveloadsave)
      * d) the second save() is of equal content */
     size_t i, extra = 64;
     size_t size = DHT_size(m->dht);
-    uint8_t buffer[size + 2 * extra];
+    VLA(uint8_t, buffer, size + 2 * extra);
     memset(buffer, 0xCD, extra);
     memset(buffer + extra + size, 0xCD, extra);
     DHT_save(m->dht, buffer + extra);
@@ -263,7 +263,7 @@ START_TEST(test_dht_state_saveloadsave)
     size_t size2 = DHT_size(m->dht);
     ck_assert_msg(size == size2, "Messenger \"grew\" in size from a store/load cycle: %u -> %u", size, size2);
 
-    uint8_t buffer2[size2];
+    VLA(uint8_t, buffer2, size2);
     DHT_save(m->dht, buffer2);
 
     ck_assert_msg(!memcmp(buffer + extra, buffer2, size), "DHT state changed by store/load/store cycle");
@@ -279,7 +279,7 @@ START_TEST(test_messenger_state_saveloadsave)
      * d) the second save() is of equal content */
     size_t i, extra = 64;
     size_t size = messenger_size(m);
-    uint8_t buffer[size + 2 * extra];
+    VLA(uint8_t, buffer, size + 2 * extra);
     memset(buffer, 0xCD, extra);
     memset(buffer + extra + size, 0xCD, extra);
     messenger_save(m, buffer + extra);
@@ -305,7 +305,7 @@ START_TEST(test_messenger_state_saveloadsave)
     size_t size2 = messenger_size(m);
     ck_assert_msg(size == size2, "Messenger \"grew\" in size from a store/load cycle: %u -> %u", size, size2);
 
-    uint8_t buffer2[size2];
+    VLA(uint8_t, buffer2, size2);
     messenger_save(m, buffer2);
 
     ck_assert_msg(!memcmp(buffer + extra, buffer2, size), "Messenger state changed by store/load/store cycle");
diff --git a/auto_tests/save_friend_test.c b/auto_tests/save_friend_test.c
index 448160c0..6d0640c3 100644
--- a/auto_tests/save_friend_test.c
+++ b/auto_tests/save_friend_test.c
@@ -4,6 +4,7 @@
 #define _XOPEN_SOURCE 600
 
 #include "helpers.h"
+#include "../toxcore/ccompat.h"
 #include "../toxcore/tox.h"
 
 #include <assert.h>
@@ -28,14 +29,14 @@ struct test_data {
 
 static void set_random(Tox *m, bool (*setter)(Tox *, const uint8_t *, size_t, TOX_ERR_SET_INFO *), size_t length)
 {
-    uint8_t text[length];
+    VLA(uint8_t, text, length);
     uint32_t i;
 
     for (i = 0; i < length; ++i) {
         text[i] = rand();
     }
 
-    setter(m, text, sizeof(text), 0);
+    setter(m, text, SIZEOF_VLA(text), 0);
 }
 
 void namechange_callback(Tox *tox, uint32_t friend_number, const uint8_t *name, size_t length, void *user_data)
@@ -106,7 +107,7 @@ int main(int argc, char *argv[])
     }
 
     size_t save_size = tox_get_savedata_size(tox1);
-    uint8_t savedata[save_size];
+    VLA(uint8_t, savedata, save_size);
     tox_get_savedata(tox1, savedata);
 
     struct Tox_Options *options = tox_options_new(NULL);
diff --git a/auto_tests/tox_one_test.c b/auto_tests/tox_one_test.c
index 8726d5c5..ce698486 100644
--- a/auto_tests/tox_one_test.c
+++ b/auto_tests/tox_one_test.c
@@ -9,6 +9,7 @@
 #include <stdlib.h>
 #include <time.h>
 
+#include "../toxcore/ccompat.h"
 #include "../toxcore/tox.h"
 #include "../toxcore/util.h"
 
@@ -77,7 +78,7 @@ START_TEST(test_one)
 
     tox_self_get_address(tox1, address);
     size_t save_size = tox_get_savedata_size(tox1);
-    uint8_t data[save_size];
+    VLA(uint8_t, data, save_size);
     tox_get_savedata(tox1, data);
 
     tox_kill(tox2);
diff --git a/auto_tests/tox_test.c b/auto_tests/tox_test.c
index ab2202d1..d9074ac0 100644
--- a/auto_tests/tox_test.c
+++ b/auto_tests/tox_test.c
@@ -21,6 +21,7 @@
 #include <stdlib.h>
 #include <time.h>
 
+#include "../toxcore/ccompat.h"
 #include "../toxcore/tox.h"
 #include "../toxcore/util.h"
 
@@ -125,7 +126,7 @@ static void handle_custom_packet(Tox *m, uint32_t friend_num, const uint8_t *dat
         return;
     }
 
-    uint8_t f_data[len];
+    VLA(uint8_t, f_data, len);
     memset(f_data, number, len);
 
     if (memcmp(f_data, data, len) == 0) {
@@ -260,7 +261,7 @@ static void tox_file_chunk_request(Tox *tox, uint32_t friend_number, uint32_t fi
     }
 
     TOX_ERR_FILE_SEND_CHUNK error;
-    uint8_t f_data[length];
+    VLA(uint8_t, f_data, length);
     memset(f_data, sending_num, length);
 
     if (tox_file_send_chunk(tox, friend_number, file_number, position, f_data, length, &error)) {
@@ -294,7 +295,7 @@ static void write_file(Tox *tox, uint32_t friendnumber, uint32_t filenumber, uin
         return;
     }
 
-    uint8_t f_data[length];
+    VLA(uint8_t, f_data, length);
     memset(f_data, num, length);
     ++num;
 
@@ -416,7 +417,7 @@ START_TEST(test_few_clients)
     unsigned int save_size1 = tox_get_savedata_size(tox2);
     ck_assert_msg(save_size1 != 0 && save_size1 < 4096, "save is invalid size %u", save_size1);
     printf("%u\n", save_size1);
-    uint8_t save1[save_size1];
+    VLA(uint8_t, save1, save_size1);
     tox_get_savedata(tox2, save1);
     tox_kill(tox2);
 
diff --git a/other/bootstrap_daemon/src/log.c b/other/bootstrap_daemon/src/log.c
index 7431838c..a0517528 100644
--- a/other/bootstrap_daemon/src/log.c
+++ b/other/bootstrap_daemon/src/log.c
@@ -26,6 +26,8 @@
 
 #include "global.h"
 
+#include "../../../toxcore/ccompat.h"
+
 #include <assert.h>
 #include <syslog.h>
 #include <stdarg.h>
@@ -94,7 +96,7 @@ static void log_syslog(LOG_LEVEL level, const char *format, va_list args)
         return;
     }
 
-    char buf[size + 1];
+    VLA(char, buf, size + 1);
     vsnprintf(buf, size + 1, format, args);
 
     syslog(level_syslog(level), "%s", buf);
diff --git a/testing/irc_syncbot.c b/testing/irc_syncbot.c
index 783be51a..91267f84 100644
--- a/testing/irc_syncbot.c
+++ b/testing/irc_syncbot.c
@@ -83,6 +83,7 @@ static int reconnect(void)
     return new_sock;
 }
 
+#include "../toxcore/ccompat.h"
 #include "../toxcore/tox.h"
 #include "misc_tools.c"
 
@@ -178,7 +179,7 @@ static void send_irc_group(Tox *tox, uint8_t *msg, uint16_t len)
         return;
     }
 
-    uint8_t req[len];
+    VLA(uint8_t, req, len);
     unsigned int i;
 
     unsigned int spaces = 0;
@@ -198,7 +199,7 @@ static void send_irc_group(Tox *tox, uint8_t *msg, uint16_t len)
     unsigned int req_len = i;
     req[i] = 0;
 
-    uint8_t message[len];
+    VLA(uint8_t, message, len);
     uint16_t length = 0;
 
     uint8_t *pmsg = (uint8_t *)strstr((char *)req, " PRIVMSG");
@@ -298,7 +299,7 @@ int main(int argc, char *argv[])
         if (count > 0) {
             last_get = get_monotime_sec();
             ping_sent = 0;
-            uint8_t data[count + 1];
+            VLA(uint8_t, data, count + 1);
             data[count] = 0;
             recv(sock, data, count, MSG_NOSIGNAL);
             printf("%s", data);
diff --git a/testing/nTox.c b/testing/nTox.c
index 160aef29..d02a1652 100644
--- a/testing/nTox.c
+++ b/testing/nTox.c
@@ -39,6 +39,7 @@
 
 #include <sys/select.h>
 
+#include "../toxcore/ccompat.h"
 #include "misc_tools.c"
 #include "nTox.h"
 
@@ -144,7 +145,7 @@ static void tox_file_chunk_request(Tox *tox, uint32_t friend_number, uint32_t fi
             }
 
             fseek(file_senders[i].file, position, SEEK_SET);
-            uint8_t data[length];
+            VLA(uint8_t, data, length);
             int len = fread(data, 1, length, file_senders[i].file);
             tox_file_send_chunk(tox, friend_number, file_number, position, data, len, 0);
             break;
@@ -266,7 +267,7 @@ static void print_friendlist(Tox *m)
     char fraddr_str[FRADDR_TOSTR_BUFSIZE];
 
     /* account for the longest name and the longest "base" string and number (int) and id_str */
-    char fstring[TOX_MAX_NAME_LENGTH + strlen(ptrn_friend) + 21 + id_str_len];
+    VLA(char, fstring, TOX_MAX_NAME_LENGTH + strlen(ptrn_friend) + 21 + id_str_len);
 
     uint32_t i = 0;
 
@@ -299,7 +300,7 @@ static void print_formatted_message(Tox *m, char *message, int friendnum, uint8_
     char name[TOX_MAX_NAME_LENGTH + 1];
     getfriendname_terminated(m, friendnum, name);
 
-    char msg[100 + strlen(message) + strlen(name) + 1];
+    VLA(char, msg, 100 + strlen(message) + strlen(name) + 1);
 
     time_t rawtime;
     struct tm *timeinfo;
@@ -920,7 +921,7 @@ static void print_message(Tox *m, uint32_t friendnumber, TOX_MESSAGE_TYPE type,
                           void *userdata)
 {
     /* ensure null termination */
-    uint8_t null_string[length + 1];
+    VLA(uint8_t, null_string, length + 1);
     memcpy(null_string, string, length);
     null_string[length] = 0;
     print_formatted_message(m, (char *)null_string, friendnumber, 0);
@@ -931,7 +932,7 @@ static void print_nickchange(Tox *m, uint32_t friendnumber, const uint8_t *strin
     char name[TOX_MAX_NAME_LENGTH + 1];
 
     if (getfriendname_terminated(m, friendnumber, name) != -1) {
-        char msg[100 + length];
+        VLA(char, msg, 100 + length);
 
         if (name[0] != 0) {
             sprintf(msg, "[i] [%d] %s is now known as %s.", friendnumber, name, string);
@@ -948,7 +949,7 @@ static void print_statuschange(Tox *m, uint32_t friendnumber, const uint8_t *str
     char name[TOX_MAX_NAME_LENGTH + 1];
 
     if (getfriendname_terminated(m, friendnumber, name) != -1) {
-        char msg[100 + length + strlen(name) + 1];
+        VLA(char, msg, 100 + length + strlen(name) + 1);
 
         if (name[0] != 0) {
             sprintf(msg, "[i] [%d] %s's status changed to %s.", friendnumber, name, string);
@@ -971,7 +972,7 @@ static Tox *load_data(void)
         size_t size = ftell(data_file);
         rewind(data_file);
 
-        uint8_t data[size];
+        VLA(uint8_t, data, size);
 
         if (fread(data, sizeof(uint8_t), size, data_file) != size) {
             fputs("[!] could not read data file!\n", stderr);
@@ -1014,7 +1015,7 @@ static int save_data(Tox *m)
 
     int res = 1;
     size_t size = tox_get_savedata_size(m);
-    uint8_t data[size];
+    VLA(uint8_t, data, size);
     tox_get_savedata(m, data);
 
     if (fwrite(data, sizeof(uint8_t), size, data_file) != size) {
@@ -1080,8 +1081,9 @@ static void print_groupchatpeers(Tox *m, int groupnumber)
         return;
     }
 
-    uint8_t names[num][TOX_MAX_NAME_LENGTH];
-    size_t lengths[num];
+    typedef uint8_t Peer_Name[TOX_MAX_NAME_LENGTH];
+    VLA(Peer_Name, names, num);
+    VLA(size_t, lengths, num);
 
     uint32_t i;
 
@@ -1126,7 +1128,7 @@ static void print_groupmessage(Tox *m, uint32_t groupnumber, uint32_t peernumber
                                const uint8_t *message, size_t length,
                                void *userdata)
 {
-    char msg[256 + length];
+    VLA(char, msg, 256 + length);
 
     TOX_ERR_CONFERENCE_PEER_QUERY error;
     size_t len = tox_conference_peer_get_name_size(m, groupnumber, peernumber, &error);
diff --git a/testing/tox_sync.c b/testing/tox_sync.c
index c719b3ec..d2fc41ca 100644
--- a/testing/tox_sync.c
+++ b/testing/tox_sync.c
@@ -34,6 +34,7 @@
 #include "config.h"
 #endif
 
+#include "../toxcore/ccompat.h"
 #include "../toxcore/tox.h"
 #include "misc_tools.c"
 
@@ -73,7 +74,7 @@ static void tox_file_chunk_request(Tox *tox, uint32_t friend_number, uint32_t fi
             }
 
             fseek(file_senders[i].file, position, SEEK_SET);
-            uint8_t data[length];
+            VLA(uint8_t, data, length);
             int len = fread(data, 1, length, file_senders[i].file);
             tox_file_send_chunk(tox, friend_number, file_number, position, data, len, 0);
             break;
@@ -314,7 +315,7 @@ int main(int argc, char *argv[])
 
             if (d) {
                 while ((dir = readdir(d)) != NULL) {
-                    char filepath[strlen(path) + strlen(dir->d_name) + 1];
+                    VLA(char, filepath, strlen(path) + strlen(dir->d_name) + 1);
                     memcpy(filepath, path, strlen(path));
                     memcpy(filepath + strlen(path), dir->d_name, strlen(dir->d_name) + 1);
                     stat(filepath, &statbuf);
diff --git a/toxav/groupav.c b/toxav/groupav.c
index 6d84b480..2e77ec53 100644
--- a/toxav/groupav.c
+++ b/toxav/groupav.c
@@ -510,14 +510,14 @@ static int send_audio_packet(Group_Chats *g_c, int groupnumber, uint8_t *packet,
     }
 
     Group_AV *group_av = (Group_AV *)group_get_object(g_c, groupnumber);
-    uint8_t data[1 + sizeof(uint16_t) + length];
+    VLA(uint8_t, data, 1 + sizeof(uint16_t) + length);
     data[0] = GROUP_AUDIO_PACKET_ID;
 
     uint16_t sequnum = htons(group_av->audio_sequnum);
     memcpy(data + 1, &sequnum, sizeof(sequnum));
     memcpy(data + 1 + sizeof(sequnum), packet, length);
 
-    if (send_group_lossy_packet(g_c, groupnumber, data, sizeof(data)) == -1) {
+    if (send_group_lossy_packet(g_c, groupnumber, data, SIZEOF_VLA(data)) == -1) {
         return -1;
     }
 
diff --git a/toxav/rtp.c b/toxav/rtp.c
index 9b7b1bfe..9403a43d 100644
--- a/toxav/rtp.c
+++ b/toxav/rtp.c
@@ -116,12 +116,12 @@ int rtp_send_data(RTPSession *session, const uint8_t *data, uint16_t length, Log
         return -1;
     }
 
-    uint8_t rdata[length + sizeof(struct RTPHeader) + 1];
-    memset(rdata, 0, sizeof(rdata));
+    VLA(uint8_t, rdata, length + sizeof(struct RTPHeader) + 1);
+    memset(rdata, 0, SIZEOF_VLA(rdata));
 
     rdata[0] = session->payload_type;
 
-    struct RTPHeader *header = (struct RTPHeader *)(rdata  + 1);
+    struct RTPHeader *header = (struct RTPHeader *)(rdata + 1);
 
     header->ve = 2;
     header->pe = 0;
@@ -147,8 +147,8 @@ int rtp_send_data(RTPSession *session, const uint8_t *data, uint16_t length, Log
 
         memcpy(rdata + 1 + sizeof(struct RTPHeader), data, length);
 
-        if (-1 == m_send_custom_lossy_packet(session->m, session->friend_number, rdata, sizeof(rdata))) {
-            LOGGER_WARNING(session->m->log, "RTP send failed (len: %d)! std error: %s", sizeof(rdata), strerror(errno));
+        if (-1 == m_send_custom_lossy_packet(session->m, session->friend_number, rdata, SIZEOF_VLA(rdata))) {
+            LOGGER_WARNING(session->m->log, "RTP send failed (len: %d)! std error: %s", SIZEOF_VLA(rdata), strerror(errno));
         }
     } else {
 
diff --git a/toxav/toxav.c b/toxav/toxav.c
index 1710f2a4..58db4597 100644
--- a/toxav/toxav.c
+++ b/toxav/toxav.c
@@ -704,12 +704,12 @@ bool toxav_audio_send_frame(ToxAV *av, uint32_t friend_number, const int16_t *pc
             goto END;
         }
 
-        uint8_t dest[sample_count + sizeof(sampling_rate)]; /* This is more than enough always */
+        VLA(uint8_t, dest, sample_count + sizeof(sampling_rate)); /* This is more than enough always */
 
         sampling_rate = htonl(sampling_rate);
         memcpy(dest, &sampling_rate, sizeof(sampling_rate));
         int vrc = opus_encode(call->audio.second->encoder, pcm, sample_count,
-                              dest + sizeof(sampling_rate), sizeof(dest) - sizeof(sampling_rate));
+                              dest + sizeof(sampling_rate), SIZEOF_VLA(dest) - sizeof(sampling_rate));
 
         if (vrc < 0) {
             LOGGER_WARNING(av->m->log, "Failed to encode frame %s", opus_strerror(vrc));
diff --git a/toxcore/DHT.c b/toxcore/DHT.c
index 5f3a1d07..227c6175 100644
--- a/toxcore/DHT.c
+++ b/toxcore/DHT.c
@@ -361,7 +361,7 @@ static int pack_ip_port(uint8_t *data, uint16_t length, const IP_Port *ip_port)
 static int DHT_create_packet(const uint8_t public_key[CRYPTO_PUBLIC_KEY_SIZE],
                              const uint8_t *shared_key, const uint8_t type, uint8_t *plain, size_t plain_length, uint8_t *packet)
 {
-    uint8_t encrypted[plain_length + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, encrypted, plain_length + CRYPTO_MAC_SIZE);
     uint8_t nonce[CRYPTO_NONCE_SIZE];
 
     random_nonce(nonce);
@@ -1264,7 +1264,7 @@ static int sendnodes_ipv6(const DHT *dht, IP_Port ip_port, const uint8_t *public
     Node_format nodes_list[MAX_SENT_NODES];
     uint32_t num_nodes = get_close_nodes(dht, client_id, nodes_list, 0, LAN_ip(ip_port.ip) == 0, 1);
 
-    uint8_t plain[1 + Node_format_size * MAX_SENT_NODES + length];
+    VLA(uint8_t, plain, 1 + Node_format_size * MAX_SENT_NODES + length);
 
     int nodes_length = 0;
 
@@ -1279,13 +1279,13 @@ static int sendnodes_ipv6(const DHT *dht, IP_Port ip_port, const uint8_t *public
     plain[0] = num_nodes;
     memcpy(plain + 1 + nodes_length, sendback_data, length);
 
-    uint8_t data[1 + nodes_length + length + 1 + CRYPTO_PUBLIC_KEY_SIZE
-                 + CRYPTO_NONCE_SIZE + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, data, 1 + nodes_length + length + 1 + CRYPTO_PUBLIC_KEY_SIZE
+        + CRYPTO_NONCE_SIZE + CRYPTO_MAC_SIZE);
 
     int len = DHT_create_packet(dht->self_public_key, shared_encryption_key, NET_PACKET_SEND_NODES_IPV6,
                                 plain, 1 + nodes_length + length, data);
 
-    if (len != sizeof(data)) {
+    if (len != SIZEOF_VLA(data)) {
         return -1;
     }
 
@@ -1375,7 +1375,7 @@ static int handle_sendnodes_core(void *object, IP_Port source, const uint8_t *pa
         return 1;
     }
 
-    uint8_t plain[1 + data_size + sizeof(uint64_t)];
+    VLA(uint8_t, plain, 1 + data_size + sizeof(uint64_t));
     uint8_t shared_key[CRYPTO_SHARED_KEY_SIZE];
     DHT_get_shared_key_sent(dht, shared_key, packet + 1);
     int len = decrypt_data_symmetric(
@@ -1385,7 +1385,7 @@ static int handle_sendnodes_core(void *object, IP_Port source, const uint8_t *pa
                   1 + data_size + sizeof(uint64_t) + CRYPTO_MAC_SIZE,
                   plain);
 
-    if ((unsigned int)len != sizeof(plain)) {
+    if ((unsigned int)len != SIZEOF_VLA(plain)) {
         return 1;
     }
 
@@ -1598,8 +1598,8 @@ static uint8_t do_ping_and_sendnode_requests(DHT *dht, uint64_t *lastgetnode, co
     uint64_t temp_time = unix_time();
 
     uint32_t num_nodes = 0;
-    Client_data *client_list[list_count * 2];
-    IPPTsPng    *assoc_list[list_count * 2];
+    VLA(Client_data *, client_list, list_count * 2);
+    VLA(IPPTsPng *, assoc_list, list_count * 2);
     unsigned int sort = 0;
     bool sort_ok = 0;
 
@@ -2247,12 +2247,12 @@ static int send_hardening_getnode_res(const DHT *dht, const Node_format *sendto,
     }
 
     uint8_t packet[MAX_CRYPTO_REQUEST_SIZE];
-    uint8_t data[1 + CRYPTO_PUBLIC_KEY_SIZE + nodes_data_length];
+    VLA(uint8_t, data, 1 + CRYPTO_PUBLIC_KEY_SIZE + nodes_data_length);
     data[0] = CHECK_TYPE_GETNODE_RES;
     memcpy(data + 1, queried_client_id, CRYPTO_PUBLIC_KEY_SIZE);
     memcpy(data + 1 + CRYPTO_PUBLIC_KEY_SIZE, nodes_data, nodes_data_length);
     int len = create_request(dht->self_public_key, dht->self_secret_key, packet, sendto->public_key, data,
-                             sizeof(data), CRYPTO_PACKET_HARDENING);
+                             SIZEOF_VLA(data), CRYPTO_PACKET_HARDENING);
 
     if (len == -1) {
         return -1;
diff --git a/toxcore/Makefile.inc b/toxcore/Makefile.inc
index f01a5d62..2ca25650 100644
--- a/toxcore/Makefile.inc
+++ b/toxcore/Makefile.inc
@@ -5,7 +5,8 @@ libtoxcore_la_include_HEADERS = \
 
 libtoxcore_la_includedir = $(includedir)/tox
 
-libtoxcore_la_SOURCES = ../toxcore/DHT.h \
+libtoxcore_la_SOURCES = ../toxcore/ccompat.h \
+                        ../toxcore/DHT.h \
                         ../toxcore/DHT.c \
                         ../toxcore/network.h \
                         ../toxcore/network.c \
diff --git a/toxcore/Messenger.c b/toxcore/Messenger.c
index 8291fab0..b13465ed 100644
--- a/toxcore/Messenger.c
+++ b/toxcore/Messenger.c
@@ -503,7 +503,7 @@ int m_send_message_generic(Messenger *m, int32_t friendnumber, uint8_t type, con
         return -3;
     }
 
-    uint8_t packet[length + 1];
+    VLA(uint8_t, packet, length + 1);
     packet[0] = type + PACKET_ID_MESSAGE;
 
     if (length != 0) {
@@ -965,7 +965,7 @@ static int write_cryptpacket_id(const Messenger *m, int32_t friendnumber, uint8_
         return 0;
     }
 
-    uint8_t packet[length + 1];
+    VLA(uint8_t, packet, length + 1);
     packet[0] = packet_id;
 
     if (length != 0) {
@@ -1111,7 +1111,7 @@ static int file_sendrequest(const Messenger *m, int32_t friendnumber, uint8_t fi
         return 0;
     }
 
-    uint8_t packet[1 + sizeof(file_type) + sizeof(filesize) + FILE_ID_LENGTH + filename_length];
+    VLA(uint8_t, packet, 1 + sizeof(file_type) + sizeof(filesize) + FILE_ID_LENGTH + filename_length);
     packet[0] = filenumber;
     file_type = htonl(file_type);
     memcpy(packet + 1, &file_type, sizeof(file_type));
@@ -1123,7 +1123,7 @@ static int file_sendrequest(const Messenger *m, int32_t friendnumber, uint8_t fi
         memcpy(packet + 1 + sizeof(file_type) + sizeof(filesize) + FILE_ID_LENGTH, filename, filename_length);
     }
 
-    return write_cryptpacket_id(m, friendnumber, PACKET_ID_FILE_SENDREQUEST, packet, sizeof(packet), 0);
+    return write_cryptpacket_id(m, friendnumber, PACKET_ID_FILE_SENDREQUEST, packet, SIZEOF_VLA(packet), 0);
 }
 
 /* Send a file send request.
@@ -1190,7 +1190,7 @@ static int send_file_control_packet(const Messenger *m, int32_t friendnumber, ui
         return -1;
     }
 
-    uint8_t packet[3 + data_length];
+    VLA(uint8_t, packet, 3 + data_length);
 
     packet[0] = send_receive;
     packet[1] = filenumber;
@@ -1200,7 +1200,7 @@ static int send_file_control_packet(const Messenger *m, int32_t friendnumber, ui
         memcpy(packet + 3, data, data_length);
     }
 
-    return write_cryptpacket_id(m, friendnumber, PACKET_ID_FILE_CONTROL, packet, sizeof(packet), 0);
+    return write_cryptpacket_id(m, friendnumber, PACKET_ID_FILE_CONTROL, packet, SIZEOF_VLA(packet), 0);
 }
 
 /* Send a file control request.
@@ -1378,7 +1378,7 @@ static int64_t send_file_data_packet(const Messenger *m, int32_t friendnumber, u
         return -1;
     }
 
-    uint8_t packet[2 + length];
+    VLA(uint8_t, packet, 2 + length);
     packet[0] = PACKET_ID_FILE_DATA;
     packet[1] = filenumber;
 
@@ -1387,7 +1387,7 @@ static int64_t send_file_data_packet(const Messenger *m, int32_t friendnumber, u
     }
 
     return write_cryptpacket(m->net_crypto, friend_connection_crypt_connection_id(m->fr_c,
-                             m->friendlist[friendnumber].friendcon_id), packet, sizeof(packet), 1);
+                             m->friendlist[friendnumber].friendcon_id), packet, SIZEOF_VLA(packet), 1);
 }
 
 #define MAX_FILE_DATA_SIZE (MAX_CRYPTO_DATA_SIZE - 2)
@@ -2132,7 +2132,7 @@ static int handle_packet(void *object, int i, const uint8_t *temp, uint16_t len,
             }
 
             /* Make sure the NULL terminator is present. */
-            uint8_t data_terminated[data_length + 1];
+            VLA(uint8_t, data_terminated, data_length + 1);
             memcpy(data_terminated, data, data_length);
             data_terminated[data_length] = 0;
 
@@ -2153,7 +2153,7 @@ static int handle_packet(void *object, int i, const uint8_t *temp, uint16_t len,
             }
 
             /* Make sure the NULL terminator is present. */
-            uint8_t data_terminated[data_length + 1];
+            VLA(uint8_t, data_terminated, data_length + 1);
             memcpy(data_terminated, data, data_length);
             data_terminated[data_length] = 0;
 
@@ -2210,7 +2210,7 @@ static int handle_packet(void *object, int i, const uint8_t *temp, uint16_t len,
             uint16_t message_length = data_length;
 
             /* Make sure the NULL terminator is present. */
-            uint8_t message_terminated[message_length + 1];
+            VLA(uint8_t, message_terminated, message_length + 1);
             memcpy(message_terminated, message, message_length);
             message_terminated[message_length] = 0;
             uint8_t type = packet_id - PACKET_ID_MESSAGE;
@@ -2272,7 +2272,7 @@ static int handle_packet(void *object, int i, const uint8_t *temp, uint16_t len,
             ft->paused = FILE_PAUSE_NOT;
             memcpy(ft->id, data + 1 + sizeof(uint32_t) + sizeof(uint64_t), FILE_ID_LENGTH);
 
-            uint8_t filename_terminated[filename_length + 1];
+            VLA(uint8_t, filename_terminated, filename_length + 1);
             uint8_t *filename = NULL;
 
             if (filename_length) {
@@ -2584,8 +2584,8 @@ void do_messenger(Messenger *m, void *userdata)
 
         /* dht contains additional "friends" (requests) */
         uint32_t num_dhtfriends = m->dht->num_friends;
-        int32_t m2dht[num_dhtfriends];
-        int32_t dht2m[num_dhtfriends];
+        VLA(int32_t, m2dht, num_dhtfriends);
+        VLA(int32_t, dht2m, num_dhtfriends);
 
         for (friend_idx = 0; friend_idx < num_dhtfriends; friend_idx++) {
             m2dht[friend_idx] = -1;
diff --git a/toxcore/TCP_client.c b/toxcore/TCP_client.c
index 3d65415e..0910534d 100644
--- a/toxcore/TCP_client.c
+++ b/toxcore/TCP_client.c
@@ -120,7 +120,7 @@ static int proxy_http_read_connection_response(TCP_Client_Connection *TCP_conn)
         unsigned int data_left = TCP_socket_data_recv_buffer(TCP_conn->sock);
 
         if (data_left) {
-            uint8_t temp_data[data_left];
+            VLA(uint8_t, temp_data, data_left);
             read_TCP_packet(TCP_conn->sock, temp_data, data_left);
         }
 
@@ -387,18 +387,18 @@ static int write_packet_TCP_secure_connection(TCP_Client_Connection *con, const
         }
     }
 
-    uint8_t packet[sizeof(uint16_t) + length + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, packet, sizeof(uint16_t) + length + CRYPTO_MAC_SIZE);
 
     uint16_t c_length = htons(length + CRYPTO_MAC_SIZE);
     memcpy(packet, &c_length, sizeof(uint16_t));
     int len = encrypt_data_symmetric(con->shared_key, con->sent_nonce, data, length, packet + sizeof(uint16_t));
 
-    if ((unsigned int)len != (sizeof(packet) - sizeof(uint16_t))) {
+    if ((unsigned int)len != (SIZEOF_VLA(packet) - sizeof(uint16_t))) {
         return -1;
     }
 
     if (priority) {
-        len = sendpriority ? send(con->sock, (const char *)packet, sizeof(packet), MSG_NOSIGNAL) : 0;
+        len = sendpriority ? send(con->sock, (const char *)packet, SIZEOF_VLA(packet), MSG_NOSIGNAL) : 0;
 
         if (len <= 0) {
             len = 0;
@@ -406,14 +406,14 @@ static int write_packet_TCP_secure_connection(TCP_Client_Connection *con, const
 
         increment_nonce(con->sent_nonce);
 
-        if ((unsigned int)len == sizeof(packet)) {
+        if ((unsigned int)len == SIZEOF_VLA(packet)) {
             return 1;
         }
 
-        return add_priority(con, packet, sizeof(packet), len);
+        return add_priority(con, packet, SIZEOF_VLA(packet), len);
     }
 
-    len = send(con->sock, (const char *)packet, sizeof(packet), MSG_NOSIGNAL);
+    len = send(con->sock, (const char *)packet, SIZEOF_VLA(packet), MSG_NOSIGNAL);
 
     if (len <= 0) {
         return 0;
@@ -421,12 +421,12 @@ static int write_packet_TCP_secure_connection(TCP_Client_Connection *con, const
 
     increment_nonce(con->sent_nonce);
 
-    if ((unsigned int)len == sizeof(packet)) {
+    if ((unsigned int)len == SIZEOF_VLA(packet)) {
         return 1;
     }
 
-    memcpy(con->last_packet, packet, sizeof(packet));
-    con->last_packet_length = sizeof(packet);
+    memcpy(con->last_packet, packet, SIZEOF_VLA(packet));
+    con->last_packet_length = SIZEOF_VLA(packet);
     con->last_packet_sent = len;
     return 1;
 }
@@ -478,10 +478,10 @@ int send_data(TCP_Client_Connection *con, uint8_t con_id, const uint8_t *data, u
         return 0;
     }
 
-    uint8_t packet[1 + length];
+    VLA(uint8_t, packet, 1 + length);
     packet[0] = con_id + NUM_RESERVED_PORTS;
     memcpy(packet + 1, data, length);
-    return write_packet_TCP_secure_connection(con, packet, sizeof(packet), 0);
+    return write_packet_TCP_secure_connection(con, packet, SIZEOF_VLA(packet), 0);
 }
 
 /* return 1 on success.
@@ -494,11 +494,11 @@ int send_oob_packet(TCP_Client_Connection *con, const uint8_t *public_key, const
         return -1;
     }
 
-    uint8_t packet[1 + CRYPTO_PUBLIC_KEY_SIZE + length];
+    VLA(uint8_t, packet, 1 + CRYPTO_PUBLIC_KEY_SIZE + length);
     packet[0] = TCP_PACKET_OOB_SEND;
     memcpy(packet + 1, public_key, CRYPTO_PUBLIC_KEY_SIZE);
     memcpy(packet + 1 + CRYPTO_PUBLIC_KEY_SIZE, data, length);
-    return write_packet_TCP_secure_connection(con, packet, sizeof(packet), 0);
+    return write_packet_TCP_secure_connection(con, packet, SIZEOF_VLA(packet), 0);
 }
 
 
@@ -614,10 +614,10 @@ int send_disconnect_request(TCP_Client_Connection *con, uint8_t con_id)
  */
 int send_onion_request(TCP_Client_Connection *con, const uint8_t *data, uint16_t length)
 {
-    uint8_t packet[1 + length];
+    VLA(uint8_t, packet, 1 + length);
     packet[0] = TCP_PACKET_ONION_REQUEST;
     memcpy(packet + 1, data, length);
-    return write_packet_TCP_secure_connection(con, packet, sizeof(packet), 0);
+    return write_packet_TCP_secure_connection(con, packet, SIZEOF_VLA(packet), 0);
 }
 
 void onion_response_handler(TCP_Client_Connection *con, int (*onion_callback)(void *object, const uint8_t *data,
diff --git a/toxcore/TCP_connection.c b/toxcore/TCP_connection.c
index 904b686e..18c1e76e 100644
--- a/toxcore/TCP_connection.c
+++ b/toxcore/TCP_connection.c
@@ -1436,7 +1436,10 @@ static void kill_nonused_tcp(TCP_Connections *tcp_c)
         return;
     }
 
-    unsigned int i, num_online = 0, num_kill = 0, to_kill[tcp_c->tcp_connections_length];
+    unsigned int i;
+    unsigned int num_online = 0;
+    unsigned int num_kill = 0;
+    VLA(unsigned int, to_kill, tcp_c->tcp_connections_length);
 
     for (i = 0; i < tcp_c->tcp_connections_length; ++i) {
         TCP_con *tcp_con = get_tcp_connection(tcp_c, i);
diff --git a/toxcore/TCP_server.c b/toxcore/TCP_server.c
index 47ad9933..10f64d38 100644
--- a/toxcore/TCP_server.c
+++ b/toxcore/TCP_server.c
@@ -325,7 +325,7 @@ int read_packet_TCP_secure_connection(Socket sock, uint16_t *next_packet_length,
         return -1;
     }
 
-    uint8_t data_encrypted[*next_packet_length];
+    VLA(uint8_t, data_encrypted, *next_packet_length);
     int len_packet = read_TCP_packet(sock, data_encrypted, *next_packet_length);
 
     if (len_packet != *next_packet_length) {
@@ -458,18 +458,18 @@ static int write_packet_TCP_secure_connection(TCP_Secure_Connection *con, const
         }
     }
 
-    uint8_t packet[sizeof(uint16_t) + length + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, packet, sizeof(uint16_t) + length + CRYPTO_MAC_SIZE);
 
     uint16_t c_length = htons(length + CRYPTO_MAC_SIZE);
     memcpy(packet, &c_length, sizeof(uint16_t));
     int len = encrypt_data_symmetric(con->shared_key, con->sent_nonce, data, length, packet + sizeof(uint16_t));
 
-    if ((unsigned int)len != (sizeof(packet) - sizeof(uint16_t))) {
+    if ((unsigned int)len != (SIZEOF_VLA(packet) - sizeof(uint16_t))) {
         return -1;
     }
 
     if (priority) {
-        len = sendpriority ? send(con->sock, (const char *)packet, sizeof(packet), MSG_NOSIGNAL) : 0;
+        len = sendpriority ? send(con->sock, (const char *)packet, SIZEOF_VLA(packet), MSG_NOSIGNAL) : 0;
 
         if (len <= 0) {
             len = 0;
@@ -477,14 +477,14 @@ static int write_packet_TCP_secure_connection(TCP_Secure_Connection *con, const
 
         increment_nonce(con->sent_nonce);
 
-        if ((unsigned int)len == sizeof(packet)) {
+        if ((unsigned int)len == SIZEOF_VLA(packet)) {
             return 1;
         }
 
-        return add_priority(con, packet, sizeof(packet), len);
+        return add_priority(con, packet, SIZEOF_VLA(packet), len);
     }
 
-    len = send(con->sock, (const char *)packet, sizeof(packet), MSG_NOSIGNAL);
+    len = send(con->sock, (const char *)packet, SIZEOF_VLA(packet), MSG_NOSIGNAL);
 
     if (len <= 0) {
         return 0;
@@ -492,12 +492,12 @@ static int write_packet_TCP_secure_connection(TCP_Secure_Connection *con, const
 
     increment_nonce(con->sent_nonce);
 
-    if ((unsigned int)len == sizeof(packet)) {
+    if ((unsigned int)len == SIZEOF_VLA(packet)) {
         return 1;
     }
 
-    memcpy(con->last_packet, packet, sizeof(packet));
-    con->last_packet_length = sizeof(packet);
+    memcpy(con->last_packet, packet, SIZEOF_VLA(packet));
+    con->last_packet_length = SIZEOF_VLA(packet);
     con->last_packet_sent = len;
     return 1;
 }
@@ -737,12 +737,12 @@ static int handle_TCP_oob_send(TCP_Server *TCP_server, uint32_t con_id, const ui
     int other_index = get_TCP_connection_index(TCP_server, public_key);
 
     if (other_index != -1) {
-        uint8_t resp_packet[1 + CRYPTO_PUBLIC_KEY_SIZE + length];
+        VLA(uint8_t, resp_packet, 1 + CRYPTO_PUBLIC_KEY_SIZE + length);
         resp_packet[0] = TCP_PACKET_OOB_RECV;
         memcpy(resp_packet + 1, con->public_key, CRYPTO_PUBLIC_KEY_SIZE);
         memcpy(resp_packet + 1 + CRYPTO_PUBLIC_KEY_SIZE, data, length);
         write_packet_TCP_secure_connection(&TCP_server->accepted_connection_array[other_index], resp_packet,
-                                           sizeof(resp_packet), 0);
+                                           SIZEOF_VLA(resp_packet), 0);
     }
 
     return 0;
@@ -800,11 +800,11 @@ static int handle_onion_recv_1(void *object, IP_Port dest, const uint8_t *data,
         return 1;
     }
 
-    uint8_t packet[1 + length];
+    VLA(uint8_t, packet, 1 + length);
     memcpy(packet + 1, data, length);
     packet[0] = TCP_PACKET_ONION_RESPONSE;
 
-    if (write_packet_TCP_secure_connection(con, packet, sizeof(packet), 0) != 1) {
+    if (write_packet_TCP_secure_connection(con, packet, SIZEOF_VLA(packet), 0) != 1) {
         return 1;
     }
 
@@ -931,7 +931,7 @@ static int handle_TCP_packet(TCP_Server *TCP_server, uint32_t con_id, const uint
 
             uint32_t index = con->connections[c_id].index;
             uint8_t other_c_id = con->connections[c_id].other_id + NUM_RESERVED_PORTS;
-            uint8_t new_data[length];
+            VLA(uint8_t, new_data, length);
             memcpy(new_data, data, length);
             new_data[0] = other_c_id;
             int ret = write_packet_TCP_secure_connection(&TCP_server->accepted_connection_array[index], new_data, length, 0);
diff --git a/toxcore/ccompat.h b/toxcore/ccompat.h
new file mode 100644
index 00000000..e72e66ae
--- /dev/null
+++ b/toxcore/ccompat.h
@@ -0,0 +1,43 @@
+/*
+ * C language compatibility macros for varying compiler support.
+ */
+#ifndef CCOMPAT_H
+#define CCOMPAT_H
+
+// Marking GNU extensions to avoid warnings.
+#if defined(__GNUC__)
+#define GNU_EXTENSION __extension__
+#else
+#define GNU_EXTENSION
+#endif
+
+// Variable length arrays.
+// VLA(type, name, size) allocates a variable length array with automatic
+// storage duration. VLA_SIZE(name) evaluates to the runtime size of that array
+// in bytes.
+//
+// If C99 VLAs are not available, an emulation using alloca (stack allocation
+// "function") is used. Note the semantic difference: alloca'd memory does not
+// get freed at the end of the declaration's scope. Do not use VLA() in loops or
+// you may run out of stack space.
+#if !defined(_MSC_VER) && __STDC_VERSION__ >= 199901L
+// C99 VLAs.
+#define VLA(type, name, size) type name[size]
+#define SIZEOF_VLA sizeof
+#else
+
+// Emulation using alloca.
+#ifdef _WIN32
+#include <malloc.h>
+#else
+#include <alloca.h>
+#endif
+
+#define VLA(type, name, size)                           \
+  const size_t name##_size = (size) * sizeof(type);     \
+  type *const name = (type *)alloca(name##_size)
+#define SIZEOF_VLA(name) name##_size
+
+#endif
+
+#endif /* CCOMPAT_H */
diff --git a/toxcore/crypto_core.c b/toxcore/crypto_core.c
index e114b44f..03150396 100644
--- a/toxcore/crypto_core.c
+++ b/toxcore/crypto_core.c
@@ -127,8 +127,8 @@ int32_t encrypt_data_symmetric(const uint8_t *secret_key, const uint8_t *nonce,
         return -1;
     }
 
-    uint8_t temp_plain[length + crypto_box_ZEROBYTES];
-    uint8_t temp_encrypted[length + crypto_box_MACBYTES + crypto_box_BOXZEROBYTES];
+    VLA(uint8_t, temp_plain, length + crypto_box_ZEROBYTES);
+    VLA(uint8_t, temp_encrypted, length + crypto_box_MACBYTES + crypto_box_BOXZEROBYTES);
 
     memset(temp_plain, 0, crypto_box_ZEROBYTES);
     memcpy(temp_plain + crypto_box_ZEROBYTES, plain, length); // Pad the message with 32 0 bytes.
@@ -149,8 +149,8 @@ int32_t decrypt_data_symmetric(const uint8_t *secret_key, const uint8_t *nonce,
         return -1;
     }
 
-    uint8_t temp_plain[length + crypto_box_ZEROBYTES];
-    uint8_t temp_encrypted[length + crypto_box_BOXZEROBYTES];
+    VLA(uint8_t, temp_plain, length + crypto_box_ZEROBYTES);
+    VLA(uint8_t, temp_encrypted, length + crypto_box_BOXZEROBYTES);
 
     memset(temp_encrypted, 0, crypto_box_BOXZEROBYTES);
     memcpy(temp_encrypted + crypto_box_BOXZEROBYTES, encrypted, length); // Pad the message with 16 0 bytes.
diff --git a/toxcore/friend_connection.c b/toxcore/friend_connection.c
index 2fb768ea..a63855af 100644
--- a/toxcore/friend_connection.c
+++ b/toxcore/friend_connection.c
@@ -791,17 +791,17 @@ int send_friend_request_packet(Friend_Connections *fr_c, int friendcon_id, uint3
         return -1;
     }
 
-    uint8_t packet[1 + sizeof(nospam_num) + length];
+    VLA(uint8_t, packet, 1 + sizeof(nospam_num) + length);
     memcpy(packet + 1, &nospam_num, sizeof(nospam_num));
     memcpy(packet + 1 + sizeof(nospam_num), data, length);
 
     if (friend_con->status == FRIENDCONN_STATUS_CONNECTED) {
         packet[0] = PACKET_ID_FRIEND_REQUESTS;
-        return write_cryptpacket(fr_c->net_crypto, friend_con->crypt_connection_id, packet, sizeof(packet), 0) != -1;
+        return write_cryptpacket(fr_c->net_crypto, friend_con->crypt_connection_id, packet, SIZEOF_VLA(packet), 0) != -1;
     }
 
     packet[0] = CRYPTO_PACKET_FRIEND_REQ;
-    int num = send_onion_data(fr_c->onion_c, friend_con->onion_friendnum, packet, sizeof(packet));
+    int num = send_onion_data(fr_c->onion_c, friend_con->onion_friendnum, packet, SIZEOF_VLA(packet));
 
     if (num <= 0) {
         return -1;
diff --git a/toxcore/friend_requests.c b/toxcore/friend_requests.c
index eedd2051..ba782e2b 100644
--- a/toxcore/friend_requests.c
+++ b/toxcore/friend_requests.c
@@ -138,9 +138,9 @@ static int friendreq_handlepacket(void *object, const uint8_t *source_pubkey, co
     addto_receivedlist(fr, source_pubkey);
 
     uint32_t message_len = length - sizeof(fr->nospam);
-    uint8_t message[message_len + 1];
+    VLA(uint8_t, message, message_len + 1);
     memcpy(message, packet + sizeof(fr->nospam), message_len);
-    message[sizeof(message) - 1] = 0; /* Be sure the message is null terminated. */
+    message[SIZEOF_VLA(message) - 1] = 0; /* Be sure the message is null terminated. */
 
     (*fr->handle_friendrequest)(fr->handle_friendrequest_object, source_pubkey, message, message_len, userdata);
     return 0;
diff --git a/toxcore/group.c b/toxcore/group.c
index c4af8fa2..5d8a6ac2 100644
--- a/toxcore/group.c
+++ b/toxcore/group.c
@@ -969,12 +969,12 @@ static unsigned int send_packet_group_peer(Friend_Connections *fr_c, int friendc
     }
 
     group_num = htons(group_num);
-    uint8_t packet[1 + sizeof(uint16_t) + length];
+    VLA(uint8_t, packet, 1 + sizeof(uint16_t) + length);
     packet[0] = packet_id;
     memcpy(packet + 1, &group_num, sizeof(uint16_t));
     memcpy(packet + 1 + sizeof(uint16_t), data, length);
     return write_cryptpacket(fr_c->net_crypto, friend_connection_crypt_connection_id(fr_c, friendcon_id), packet,
-                             sizeof(packet), 0) != -1;
+                             SIZEOF_VLA(packet), 0) != -1;
 }
 
 /* Send a group lossy packet to friendcon_id.
@@ -990,12 +990,12 @@ static unsigned int send_lossy_group_peer(Friend_Connections *fr_c, int friendco
     }
 
     group_num = htons(group_num);
-    uint8_t packet[1 + sizeof(uint16_t) + length];
+    VLA(uint8_t, packet, 1 + sizeof(uint16_t) + length);
     packet[0] = packet_id;
     memcpy(packet + 1, &group_num, sizeof(uint16_t));
     memcpy(packet + 1 + sizeof(uint16_t), data, length);
     return send_lossy_cryptpacket(fr_c->net_crypto, friend_connection_crypt_connection_id(fr_c, friendcon_id), packet,
-                                  sizeof(packet)) != -1;
+                                  SIZEOF_VLA(packet)) != -1;
 }
 
 #define INVITE_PACKET_SIZE (1 + sizeof(uint16_t) + GROUP_IDENTIFIER_LENGTH)
@@ -1646,10 +1646,10 @@ static unsigned int send_peers(Group_Chats *g_c, int groupnumber, int friendcon_
     }
 
     if (g->title_len) {
-        uint8_t Packet[1 + g->title_len];
+        VLA(uint8_t, Packet, 1 + g->title_len);
         Packet[0] = PEER_TITLE_ID;
         memcpy(Packet + 1, g->title, g->title_len);
-        send_packet_group_peer(g_c->fr_c, friendcon_id, PACKET_ID_DIRECT_CONFERENCE, group_num, Packet, sizeof(Packet));
+        send_packet_group_peer(g_c->fr_c, friendcon_id, PACKET_ID_DIRECT_CONFERENCE, group_num, Packet, SIZEOF_VLA(Packet));
     }
 
     return sent;
@@ -1902,7 +1902,7 @@ static int send_message_group(const Group_Chats *g_c, int groupnumber, uint8_t m
         return -3;
     }
 
-    uint8_t packet[sizeof(uint16_t) + sizeof(uint32_t) + 1 + len];
+    VLA(uint8_t, packet, sizeof(uint16_t) + sizeof(uint32_t) + 1 + len);
     uint16_t peer_num = htons(g->peer_number);
     memcpy(packet, &peer_num, sizeof(peer_num));
 
@@ -1921,7 +1921,7 @@ static int send_message_group(const Group_Chats *g_c, int groupnumber, uint8_t m
         memcpy(packet + sizeof(uint16_t) + sizeof(uint32_t) + 1, data, len);
     }
 
-    unsigned int ret = send_message_all_close(g_c, groupnumber, packet, sizeof(packet), -1);
+    unsigned int ret = send_message_all_close(g_c, groupnumber, packet, SIZEOF_VLA(packet), -1);
 
     return (ret == 0) ? -4 : ret;
 }
@@ -1970,14 +1970,14 @@ int send_group_lossy_packet(const Group_Chats *g_c, int groupnumber, const uint8
         return -1;
     }
 
-    uint8_t packet[sizeof(uint16_t) * 2 + length];
+    VLA(uint8_t, packet, sizeof(uint16_t) * 2 + length);
     uint16_t peer_number = htons(g->peer_number);
     memcpy(packet, &peer_number, sizeof(uint16_t));
     uint16_t message_num = htons(g->lossy_message_number);
     memcpy(packet + sizeof(uint16_t), &message_num, sizeof(uint16_t));
     memcpy(packet + sizeof(uint16_t) * 2, data, length);
 
-    if (send_lossy_all_close(g_c, groupnumber, packet, sizeof(packet), -1) == 0) {
+    if (send_lossy_all_close(g_c, groupnumber, packet, SIZEOF_VLA(packet), -1) == 0) {
         return -1;
     }
 
@@ -2088,7 +2088,7 @@ static void handle_message_packet_group(Group_Chats *g_c, int groupnumber, const
                 return;
             }
 
-            uint8_t newmsg[msg_data_len + 1];
+            VLA(uint8_t, newmsg, msg_data_len + 1);
             memcpy(newmsg, msg_data, msg_data_len);
             newmsg[msg_data_len] = 0;
 
@@ -2105,7 +2105,7 @@ static void handle_message_packet_group(Group_Chats *g_c, int groupnumber, const
                 return;
             }
 
-            uint8_t newmsg[msg_data_len + 1];
+            VLA(uint8_t, newmsg, msg_data_len + 1);
             memcpy(newmsg, msg_data, msg_data_len);
             newmsg[msg_data_len] = 0;
 
diff --git a/toxcore/net_crypto.c b/toxcore/net_crypto.c
index cc3c5226..ecd0177c 100644
--- a/toxcore/net_crypto.c
+++ b/toxcore/net_crypto.c
@@ -903,12 +903,12 @@ static int send_data_packet(Net_Crypto *c, int crypt_connection_id, const uint8_
     }
 
     pthread_mutex_lock(&conn->mutex);
-    uint8_t packet[1 + sizeof(uint16_t) + length + CRYPTO_MAC_SIZE];
+    VLA(uint8_t, packet, 1 + sizeof(uint16_t) + length + CRYPTO_MAC_SIZE);
     packet[0] = NET_PACKET_CRYPTO_DATA;
     memcpy(packet + 1, conn->sent_nonce + (CRYPTO_NONCE_SIZE - sizeof(uint16_t)), sizeof(uint16_t));
     int len = encrypt_data_symmetric(conn->shared_key, conn->sent_nonce, data, length, packet + 1 + sizeof(uint16_t));
 
-    if (len + 1 + sizeof(uint16_t) != sizeof(packet)) {
+    if (len + 1 + sizeof(uint16_t) != SIZEOF_VLA(packet)) {
         pthread_mutex_unlock(&conn->mutex);
         return -1;
     }
@@ -916,7 +916,7 @@ static int send_data_packet(Net_Crypto *c, int crypt_connection_id, const uint8_
     increment_nonce(conn->sent_nonce);
     pthread_mutex_unlock(&conn->mutex);
 
-    return send_packet_to(c, crypt_connection_id, packet, sizeof(packet));
+    return send_packet_to(c, crypt_connection_id, packet, SIZEOF_VLA(packet));
 }
 
 /* Creates and sends a data packet with buffer_start and num to the peer using the fastest route.
@@ -934,13 +934,13 @@ static int send_data_packet_helper(Net_Crypto *c, int crypt_connection_id, uint3
     num = htonl(num);
     buffer_start = htonl(buffer_start);
     uint16_t padding_length = (MAX_CRYPTO_DATA_SIZE - length) % CRYPTO_MAX_PADDING;
-    uint8_t packet[sizeof(uint32_t) + sizeof(uint32_t) + padding_length + length];
+    VLA(uint8_t, packet, sizeof(uint32_t) + sizeof(uint32_t) + padding_length + length);
     memcpy(packet, &buffer_start, sizeof(uint32_t));
     memcpy(packet + sizeof(uint32_t), &num, sizeof(uint32_t));
     memset(packet + (sizeof(uint32_t) * 2), PACKET_ID_PADDING, padding_length);
     memcpy(packet + (sizeof(uint32_t) * 2) + padding_length, data, length);
 
-    return send_data_packet(c, crypt_connection_id, packet, sizeof(packet));
+    return send_data_packet(c, crypt_connection_id, packet, SIZEOF_VLA(packet));
 }
 
 static int reset_max_speed_reached(Net_Crypto *c, int crypt_connection_id)
diff --git a/toxcore/network.h b/toxcore/network.h
index a3b746c9..bcd1abd1 100644
--- a/toxcore/network.h
+++ b/toxcore/network.h
@@ -24,18 +24,13 @@
 #ifndef NETWORK_H
 #define NETWORK_H
 
-#if defined(__GNUC__)
-#define GNU_EXTENSION __extension__
-#else
-#define GNU_EXTENSION
-#endif
-
 #ifdef PLAN9
 #include <u.h> // Plan 9 requires this is imported first
 // Comment line here to avoid reordering by source code formatters.
 #include <libc.h>
 #endif
 
+#include "ccompat.h"
 #include "logger.h"
 
 #include <stdint.h>
diff --git a/toxcore/onion.c b/toxcore/onion.c
index 1d5cc71f..60fdcce0 100644
--- a/toxcore/onion.c
+++ b/toxcore/onion.c
@@ -185,7 +185,7 @@ int create_onion_packet(uint8_t *packet, uint16_t max_packet_length, const Onion
         return -1;
     }
 
-    uint8_t step1[SIZE_IPPORT + length];
+    VLA(uint8_t, step1, SIZE_IPPORT + length);
 
     ipport_pack(step1, &dest);
     memcpy(step1 + SIZE_IPPORT, data, length);
@@ -193,21 +193,21 @@ int create_onion_packet(uint8_t *packet, uint16_t max_packet_length, const Onion
     uint8_t nonce[CRYPTO_NONCE_SIZE];
     random_nonce(nonce);
 
-    uint8_t step2[SIZE_IPPORT + SEND_BASE + length];
+    VLA(uint8_t, step2, SIZE_IPPORT + SEND_BASE + length);
     ipport_pack(step2, &path->ip_port3);
     memcpy(step2 + SIZE_IPPORT, path->public_key3, CRYPTO_PUBLIC_KEY_SIZE);
 
-    int len = encrypt_data_symmetric(path->shared_key3, nonce, step1, sizeof(step1),
+    int len = encrypt_data_symmetric(path->shared_key3, nonce, step1, SIZEOF_VLA(step1),
                                      step2 + SIZE_IPPORT + CRYPTO_PUBLIC_KEY_SIZE);
 
     if (len != SIZE_IPPORT + length + CRYPTO_MAC_SIZE) {
         return -1;
     }
 
-    uint8_t step3[SIZE_IPPORT + SEND_BASE * 2 + length];
+    VLA(uint8_t, step3, SIZE_IPPORT + SEND_BASE * 2 + length);
     ipport_pack(step3, &path->ip_port2);
     memcpy(step3 + SIZE_IPPORT, path->public_key2, CRYPTO_PUBLIC_KEY_SIZE);
-    len = encrypt_data_symmetric(path->shared_key2, nonce, step2, sizeof(step2),
+    len = encrypt_data_symmetric(path->shared_key2, nonce, step2, SIZEOF_VLA(step2),
                                  step3 + SIZE_IPPORT + CRYPTO_PUBLIC_KEY_SIZE);
 
     if (len != SIZE_IPPORT + SEND_BASE + length + CRYPTO_MAC_SIZE) {
@@ -218,7 +218,7 @@ int create_onion_packet(uint8_t *packet, uint16_t max_packet_length, const Onion
     memcpy(packet + 1, nonce, CRYPTO_NONCE_SIZE);
     memcpy(packet + 1 + CRYPTO_NONCE_SIZE, path->public_key1, CRYPTO_PUBLIC_KEY_SIZE);
 
-    len = encrypt_data_symmetric(path->shared_key1, nonce, step3, sizeof(step3),
+    len = encrypt_data_symmetric(path->shared_key1, nonce, step3, SIZEOF_VLA(step3),
                                  packet + 1 + CRYPTO_NONCE_SIZE + CRYPTO_PUBLIC_KEY_SIZE);
 
     if (len != SIZE_IPPORT + SEND_BASE * 2 + length + CRYPTO_MAC_SIZE) {
@@ -244,7 +244,7 @@ int create_onion_packet_tcp(uint8_t *packet, uint16_t max_packet_length, const O
         return -1;
     }
 
-    uint8_t step1[SIZE_IPPORT + length];
+    VLA(uint8_t, step1, SIZE_IPPORT + length);
 
     ipport_pack(step1, &dest);
     memcpy(step1 + SIZE_IPPORT, data, length);
@@ -252,11 +252,11 @@ int create_onion_packet_tcp(uint8_t *packet, uint16_t max_packet_length, const O
     uint8_t nonce[CRYPTO_NONCE_SIZE];
     random_nonce(nonce);
 
-    uint8_t step2[SIZE_IPPORT + SEND_BASE + length];
+    VLA(uint8_t, step2, SIZE_IPPORT + SEND_BASE + length);
     ipport_pack(step2, &path->ip_port3);
     memcpy(step2 + SIZE_IPPORT, path->public_key3, CRYPTO_PUBLIC_KEY_SIZE);
 
-    int len = encrypt_data_symmetric(path->shared_key3, nonce, step1, sizeof(step1),
+    int len = encrypt_data_symmetric(path->shared_key3, nonce, step1, SIZEOF_VLA(step1),
                                      step2 + SIZE_IPPORT + CRYPTO_PUBLIC_KEY_SIZE);
 
     if (len != SIZE_IPPORT + length + CRYPTO_MAC_SIZE) {
@@ -265,7 +265,7 @@ int create_onion_packet_tcp(uint8_t *packet, uint16_t max_packet_length, const O
 
     ipport_pack(packet + CRYPTO_NONCE_SIZE, &path->ip_port2);
     memcpy(packet + CRYPTO_NONCE_SIZE + SIZE_IPPORT, path->public_key2, CRYPTO_PUBLIC_KEY_SIZE);
-    len = encrypt_data_symmetric(path->shared_key2, nonce, step2, sizeof(step2),
+    len = encrypt_data_symmetric(path->shared_key2, nonce, step2, SIZEOF_VLA(step2),
                                  packet + CRYPTO_NONCE_SIZE + SIZE_IPPORT + CRYPTO_PUBLIC_KEY_SIZE);
 
     if (len != SIZE_IPPORT + SEND_BASE + length + CRYPTO_MAC_SIZE) {
@@ -313,12 +313,12 @@ int send_onion_response(Networking_Core *net, IP_Port dest, const uint8_t *data,
         return -1;
     }
 
-    uint8_t packet[1 + RETURN_3 + length];
+    VLA(uint8_t, packet, 1 + RETURN_3 + length);
     packet[0] = NET_PACKET_ONION_RECV_3;
     memcpy(packet + 1, ret, RETURN_3);
     memcpy(packet + 1 + RETURN_3, data, length);
 
-    if ((uint32_t)sendpacket(net, dest, packet, sizeof(packet)) != sizeof(packet)) {
+    if ((uint32_t)sendpacket(net, dest, packet, SIZEOF_VLA(packet)) != SIZEOF_VLA(packet)) {
         return -1;
     }
 
diff --git a/toxcore/onion_announce.c b/toxcore/onion_announce.c
index aa287d12..04450c57 100644
--- a/toxcore/onion_announce.c
+++ b/toxcore/onion_announce.c
@@ -426,11 +426,11 @@ static int handle_data_request(void *object, IP_Port source, const uint8_t *pack
         return 1;
     }
 
-    uint8_t data[length - (CRYPTO_PUBLIC_KEY_SIZE + ONION_RETURN_3)];
+    VLA(uint8_t, data, length - (CRYPTO_PUBLIC_KEY_SIZE + ONION_RETURN_3));
     data[0] = NET_PACKET_ONION_DATA_RESPONSE;
     memcpy(data + 1, packet + 1 + CRYPTO_PUBLIC_KEY_SIZE, length - (1 + CRYPTO_PUBLIC_KEY_SIZE + ONION_RETURN_3));
 
-    if (send_onion_response(onion_a->net, onion_a->entries[index].ret_ip_port, data, sizeof(data),
+    if (send_onion_response(onion_a->net, onion_a->entries[index].ret_ip_port, data, SIZEOF_VLA(data),
                             onion_a->entries[index].ret) == -1) {
         return 1;
     }
diff --git a/toxcore/onion_client.c b/toxcore/onion_client.c
index d324dbf2..a20d3d70 100644
--- a/toxcore/onion_client.c
+++ b/toxcore/onion_client.c
@@ -681,7 +681,7 @@ static int handle_announce_response(void *object, IP_Port source, const uint8_t
         return 1;
     }
 
-    uint8_t plain[1 + ONION_PING_ID_SIZE + len_nodes];
+    VLA(uint8_t, plain, 1 + ONION_PING_ID_SIZE + len_nodes);
     int len = -1;
 
     if (num == 0) {
@@ -699,7 +699,7 @@ static int handle_announce_response(void *object, IP_Port source, const uint8_t
                            length - (1 + ONION_ANNOUNCE_SENDBACK_DATA_LENGTH + CRYPTO_NONCE_SIZE), plain);
     }
 
-    if ((uint32_t)len != sizeof(plain)) {
+    if ((uint32_t)len != SIZEOF_VLA(plain)) {
         return 1;
     }
 
@@ -739,20 +739,20 @@ static int handle_data_response(void *object, IP_Port source, const uint8_t *pac
         return 1;
     }
 
-    uint8_t temp_plain[length - ONION_DATA_RESPONSE_MIN_SIZE];
+    VLA(uint8_t, temp_plain, length - ONION_DATA_RESPONSE_MIN_SIZE);
     int len = decrypt_data(packet + 1 + CRYPTO_NONCE_SIZE, onion_c->temp_secret_key, packet + 1,
                            packet + 1 + CRYPTO_NONCE_SIZE + CRYPTO_PUBLIC_KEY_SIZE,
                            length - (1 + CRYPTO_NONCE_SIZE + CRYPTO_PUBLIC_KEY_SIZE), temp_plain);
 
-    if ((uint32_t)len != sizeof(temp_plain)) {
+    if ((uint32_t)len != SIZEOF_VLA(temp_plain)) {
         return 1;
     }
 
-    uint8_t plain[sizeof(temp_plain) - DATA_IN_RESPONSE_MIN_SIZE];
+    VLA(uint8_t, plain, SIZEOF_VLA(temp_plain) - DATA_IN_RESPONSE_MIN_SIZE);
     len = decrypt_data(temp_plain, onion_c->c->self_secret_key, packet + 1, temp_plain + CRYPTO_PUBLIC_KEY_SIZE,
-                       sizeof(temp_plain) - CRYPTO_PUBLIC_KEY_SIZE, plain);
+                       SIZEOF_VLA(temp_plain) - CRYPTO_PUBLIC_KEY_SIZE, plain);
 
-    if ((uint32_t)len != sizeof(plain)) {
+    if ((uint32_t)len != SIZEOF_VLA(plain)) {
         return 1;
     }
 
@@ -761,7 +761,7 @@ static int handle_data_response(void *object, IP_Port source, const uint8_t *pac
     }
 
     return onion_c->Onion_Data_Handlers[plain[0]].function(onion_c->Onion_Data_Handlers[plain[0]].object, temp_plain, plain,
-            sizeof(plain), userdata);
+            SIZEOF_VLA(plain), userdata);
 }
 
 #define DHTPK_DATA_MIN_LENGTH (1 + sizeof(uint64_t) + CRYPTO_PUBLIC_KEY_SIZE)
@@ -899,12 +899,12 @@ int send_onion_data(Onion_Client *onion_c, int friend_num, const uint8_t *data,
     uint8_t nonce[CRYPTO_NONCE_SIZE];
     random_nonce(nonce);
 
-    uint8_t packet[DATA_IN_RESPONSE_MIN_SIZE + length];
+    VLA(uint8_t, packet, DATA_IN_RESPONSE_MIN_SIZE + length);
     memcpy(packet, onion_c->c->self_public_key, CRYPTO_PUBLIC_KEY_SIZE);
     int len = encrypt_data(onion_c->friends_list[friend_num].real_public_key, onion_c->c->self_secret_key, nonce, data,
                            length, packet + CRYPTO_PUBLIC_KEY_SIZE);
 
-    if ((uint32_t)len + CRYPTO_PUBLIC_KEY_SIZE != sizeof(packet)) {
+    if ((uint32_t)len + CRYPTO_PUBLIC_KEY_SIZE != SIZEOF_VLA(packet)) {
         return -1;
     }
 
@@ -919,7 +919,7 @@ int send_onion_data(Onion_Client *onion_c, int friend_num, const uint8_t *data,
 
         uint8_t o_packet[ONION_MAX_PACKET_SIZE];
         len = create_data_request(o_packet, sizeof(o_packet), onion_c->friends_list[friend_num].real_public_key,
-                                  list_nodes[good_nodes[i]].data_public_key, nonce, packet, sizeof(packet));
+                                  list_nodes[good_nodes[i]].data_public_key, nonce, packet, SIZEOF_VLA(packet));
 
         if (len == -1) {
             continue;
@@ -953,19 +953,19 @@ static int send_dht_dhtpk(const Onion_Client *onion_c, int friend_num, const uin
     uint8_t nonce[CRYPTO_NONCE_SIZE];
     random_nonce(nonce);
 
-    uint8_t temp[DATA_IN_RESPONSE_MIN_SIZE + CRYPTO_NONCE_SIZE + length];
+    VLA(uint8_t, temp, DATA_IN_RESPONSE_MIN_SIZE + CRYPTO_NONCE_SIZE + length);
     memcpy(temp, onion_c->c->self_public_key, CRYPTO_PUBLIC_KEY_SIZE);
     memcpy(temp + CRYPTO_PUBLIC_KEY_SIZE, nonce, CRYPTO_NONCE_SIZE);
     int len = encrypt_data(onion_c->friends_list[friend_num].real_public_key, onion_c->c->self_secret_key, nonce, data,
                            length, temp + CRYPTO_PUBLIC_KEY_SIZE + CRYPTO_NONCE_SIZE);
 
-    if ((uint32_t)len + CRYPTO_PUBLIC_KEY_SIZE + CRYPTO_NONCE_SIZE != sizeof(temp)) {
+    if ((uint32_t)len + CRYPTO_PUBLIC_KEY_SIZE + CRYPTO_NONCE_SIZE != SIZEOF_VLA(temp)) {
         return -1;
     }
 
     uint8_t packet[MAX_CRYPTO_REQUEST_SIZE];
     len = create_request(onion_c->dht->self_public_key, onion_c->dht->self_secret_key, packet,
-                         onion_c->friends_list[friend_num].dht_public_key, temp, sizeof(temp), CRYPTO_PACKET_DHTPK);
+                         onion_c->friends_list[friend_num].dht_public_key, temp, SIZEOF_VLA(temp), CRYPTO_PACKET_DHTPK);
 
     if (len == -1) {
         return -1;
diff --git a/toxcore/util.c b/toxcore/util.c
index 22fa0fc9..92bbb68c 100644
--- a/toxcore/util.c
+++ b/toxcore/util.c
@@ -79,7 +79,7 @@ void host_to_net(uint8_t *num, uint16_t numbytes)
 {
 #ifndef WORDS_BIGENDIAN
     uint32_t i;
-    uint8_t buff[numbytes];
+    VLA(uint8_t, buff, numbytes);
 
     for (i = 0; i < numbytes; ++i) {
         buff[i] = num[numbytes - i - 1];
diff --git a/toxdns/toxdns.c b/toxdns/toxdns.c
index 3fb43452..96f3081f 100644
--- a/toxdns/toxdns.c
+++ b/toxdns/toxdns.c
@@ -220,10 +220,10 @@ int tox_decrypt_dns3_TXT(void *dns3_object, uint8_t *tox_id, uint8_t *id_record,
 
 #endif
 
-    uint8_t id_record_null[id_record_len + 1];
+    VLA(uint8_t, id_record_null, id_record_len + 1);
     memcpy(id_record_null, id_record, id_record_len);
     id_record_null[id_record_len] = 0;
-    uint8_t data[id_record_len];
+    VLA(uint8_t, data, id_record_len);
     int length = decode(data, id_record_null);
 
     if (length == -1) {