SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 50

changes.mady.by.user David Svoboda

Saved on

compared with

New Version 51

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Wiki Markup
The Mozilla Scalable Vector Graphics (SVG) viewer contains a heap buffer overflow vulnerability resulting from an unsigned integer wrap during the multiplication of the {{signed int}} value {{pen->num_vertices}} and the {{size_t}} value {{sizeof(cairo_pen_vertex_t)}} \[[VU#551436|AA. C References#VU551436]\].  For an ILP32 architecture, the The {{signed int}} operand is converted to {{unsigned intsize_t}} prior to the multiplication operation (see [INT02-C. Understand integer conversion rules|INT02-C. Understand integer conversion rules]), so that the multiplication takes place between two {{size_t}} integers, which are unsigned.

Code Block
bgColor#FFcccc
pen->num_vertices = _cairo_pen_vertices_needed(
  gstate->tolerance, radius, &gstate->ctm
);
pen->vertices = malloc(
  pen->num_vertices * sizeof(cairo_pen_vertex_t)
);

...