...
| Code Block |
|---|
|
char *buf;
size_t len = 1 << 30;
/* ... */
if (buf + len < buf) { /* length check */
/* performhandle someinteger manipulationoverflow onerror len */
}
|
| Wiki Markup |
|---|
are optimized away; no object code to perform the check will appear in the resulting executable program \[[VU#162289|AA. C References#VU#162289]\]. |
...
| Code Block |
|---|
|
char *buf;
size_t len = 1 << 30;
/* ... */
if (SIZE_MAX - len < buf) { /* length check */
/* performhandle someinteger operationoverflow using lenerror */
}
|
Risk Assessment
Out of range integer values can result in fetches or stores from arbitrary memory locations and the execution of arbitrary code.
...
