Following code illustrates integer overflow condition:
#include <stdio.h>
#include <memory.h>
#include <stdlib.h>
unsigned char *createTable(unsigned int w, unsigned int h, unsigned char *initialRow);
int main(int argc, char **argv)
{
unsigned char row[2] = { 'a' };
unsigned char *wholeTable;
unsigned int user_provided_w = 0x400;
unsigned int user_provided_h = 0x1000001;
wholeTable = createTable(user_provided_w, user_provided_h, row);
free(wholeTable);
return 0;
}
unsigned char *createTable(unsigned int w, unsigned int h, unsigned char *initialRow)
{
unsigned int n;
int i;
unsigned char *buf;
n = w * h;
buf = (char *)malloc(n);
if(!buf)
return NULL;
for(i=0; i<h; ++i)
memcpy(&buf[i*w], initialRow, w);
return buf;
}
The purpose of createTable(...) function is to take width and height and an initial row and create table in which all rows are initialized with initialRow. However we can observe that there can be integer overflow condition (bolded line), when width and height will be big enough. Lets assume width = 0x400 and height = 0x1000001 in this situation n will be equal to 1024 (in decimal), so only 1024 bytes will be allocated. Following for loop will be iterated 0x1000001 times so heap buffer overflow will occur.
