twin
twin copied to clipboard
Integer overflow when calculating AllocMem() size
https://github.com/cosmos72/twin/blob/b6e4e4bbae457447792a6d7b899e966c2b6571be/server/resize.cpp#L127-L129 This allocation size is derived from user input and the multiplication might overflow. Consider adding upper bounds for x and y, e.g.
if (x > 0 && y > 0 && x < 1000 && y < 1000) {
if (!(saveNewCont = NewCont = (tcell *)AllocMem(x * y * sizeof(tcell))))
return false;
Thanks for spotting this! Yes, that code shoud check for overflows before the multiplication.