...
In this noncompliant code example, length is the value of a user-defined (and thus potentially untrusted) environment variable whose value is used to determine the size of a dynamically allocated array, table. In compliance with INT30-C. Ensure that unsigned integer operations do not wrap, the code prevents unsigned integer wrapping but doesn't impose any upper bound on the size of the array, making it possible for the user to cause the program to use an excessive amount of memory.
...
The test for length == 0 ensures that a nonzero number of bytes is allocated. (See MEM04-C. Do not perform zero-length allocations.)
Risk Assessment
...
ISO/IEC TR 17961 (Draft) Tainted, potentially mutilated, or out-of-domain integer values are used in a restricted sink [taintsink]
Bibliography
[Seacord 2005a] Chapter 5, "Integer Security"
...