search

coin-or / Clp

COIN-OR Linear Programming Solver
Other
396 stars 82 forks source link

Potential Integer Overflow vulnerability in Clp/src/unitTest.cpp #200

Open KSB21ST opened 3 years ago

KSB21ST commented 3 years ago

Hi, It seems that there exists a potential integer overflow. Please find the following description:

  1. numberRows can be an arbitrary large number https://github.com/coin-or/Clp/blob/d4ccc9a853c739cc7d07329af32dfe829095c5fa/Clp/src/unitTest.cpp#L2373

  2. Call to malloc with the large integer can cause a memory allocation with an overflowed size https://github.com/coin-or/Clp/blob/d4ccc9a853c739cc7d07329af32dfe829095c5fa/Clp/src/unitTest.cpp#L2412