Open
Description
Hi, there are potential integer overflow vulnerabilities that can affect the 32bit system.
In src/util/output.c:59, the program reads the value of numOfVars from input file and calls createVector.
fscanf(in,"%d",numOfVars);
if (numOfVectors==0) return (0);
b=createVector(*numOfVars);Since there is no range check in createVector, it may cause integer overflow and small buffer allocation which leads to buggy behavior.
vector createVector(int numOfVars) {
vector w;
w = (vector)malloc(sizeof(int)*(numOfVars+1));
if (w==0) {
printf("Could not allocate memory in function createVector.\n");
printf("Please report this problem.\n");
exit(0);
}
return (w);
}Similar issues can happen in
Line 720 in 4d70ab9
Line 859 in 4d70ab9
Thank you.
Metadata
Metadata
Assignees
Labels
No labels