CVE-2024-25110: Insufficient Information (NVD-CWE-noinfo)
value: The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. Users are advised to update the submodule with commit `30865c9c`. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-12T20:15Z
Repository: https://github.com/Azure/azure-uamqp-c
Language: C
Files changed: src/message.c
Commit date: 2024-02-01 16:37:53 -0800
Commit message: Use safe math in message.c (#452)


Diff: diff --git a/src/message.c b/src/message.c
index 55e072d..6073d1f 100644
--- a/src/message.c
+++ b/src/message.c
@@ -5,10 +5,11 @@
 #include <string.h>
 #include <stdint.h>
 #include "azure_macro_utils/macro_utils.h"
 #include "azure_c_shared_utility/gballoc.h"
 #include "azure_c_shared_utility/xlogging.h"
+#include "azure_c_shared_utility/safe_math.h"
 #include "azure_uamqp_c/amqp_definitions.h"
 #include "azure_uamqp_c/message.h"
 #include "azure_uamqp_c/amqpvalue.h"
 
 typedef struct BODY_AMQP_DATA_TAG
@@ -230,82 +231,104 @@ MESSAGE_HANDLE message_clone(MESSAGE_HANDLE source_message)
                 }
             }
 
             if ((result != NULL) && (source_message->body_amqp_data_count > 0))
             {
-                size_t i;
+                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_data_count, sizeof(BODY_AMQP_DATA));
 
-                result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, (source_message->body_amqp_data_count * sizeof(BODY_AMQP_DATA)));
-                if (result->body_amqp_data_items == NULL)
+                if (calloc_size == SIZE_MAX)
                 {
-                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
-                    LogError("Cannot allocate memory for body data sections");
-                    message_destroy(result);
+                    LogError("Invalid size for body_amqp_data_items");
                     result = NULL;
                 }
                 else
                 {
-                    for (i = 0; i < source_message->body_amqp_data_count; i++)
+                    result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, calloc_size);
+
+                    if (result->body_amqp_data_items == NULL)
                     {
-                        result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
+                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
+                        LogError("Cannot allocate memory for body data sections");
+                        message_destroy(result);
+                        result = NULL;
+                    }
+                    else
+                    {
+                        size_t i;
 
-                        /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
-                        result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
-                        if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
+                        for (i = 0; i < source_message->body_amqp_data_count; i++)
                         {
-                            LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
-                            break;
+                            result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
+
+                            /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
+                            result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
+                            if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
+                            {
+                                LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
+                                break;
+                            }
+                            else
+                            {
+                                (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
+                            }
                         }
-                        else
+
+                        result->body_amqp_data_count = i;
+                        if (i < source_message->body_amqp_data_count)
                         {
-                            (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
+                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
+                            message_destroy(result);
+                            result = NULL;
                         }
                     }
-
-                    result->body_amqp_data_count = i;
-                    if (i < source_message->body_amqp_data_count)
-                    {
-                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
-                        message_destroy(result);
-                        result = NULL;
-                    }
                 }
             }
 
             if ((result != NULL) && (source_message->body_amqp_sequence_count > 0))
             {
-                size_t i;
+                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_sequence_count, sizeof(AMQP_VALUE));
 
-                result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, (source_message->body_amqp_sequence_count * sizeof(AMQP_VALUE)));
-                if (result->body_amqp_sequence_items == NULL)
+                if (calloc_size == SIZE_MAX)
                 {
-                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
-                    LogError("Cannot allocate memory for body AMQP sequences");
+                    LogError("Invalid size for body_amqp_sequence_items");
                     message_destroy(result);
                     result = NULL;
                 }
                 else
                 {
-                    for (i = 0; i < source_message->body_amqp_sequence_count; i++)
-                    {
-                        /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
-                        result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
-                        if (result->body_amqp_sequence_items[i] == NULL)
-                        {
-                            LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
-                            break;
-                        }
-                    }
-
-                    result->body_amqp_sequence_count = i;
-                    if (i < source_message->body_amqp_sequence_count)
+                    result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, calloc_size);
+                    if (result->body_amqp_sequence_items == NULL)
                     {
                         /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
+                        LogError("Cannot allocate memory for body AMQP sequences");
                         message_destroy(result);
                         result = NULL;
                     }
-                }
+                    else
+                    {
+                        size_t i;
+
+                        for (i = 0; i < source_message->body_amqp_sequence_count; i++)
+                        {
+                            /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
+                            result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
+                            if (result->body_amqp_sequence_items[i] == NULL)
+                            {
+                                LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
+                                break;
+                            }
+                        }
+
+                        result->body_amqp_sequence_count = i;
+                        if (i < source_message->body_amqp_sequence_count)
+                        {
+                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
+                            message_destroy(result);
+                            result = NULL;
+                        }
+                    }
+				}
             }
 
             if ((result != NULL) && (source_message->body_amqp_value != NULL))
             {
                 /* Codes_SRS_MESSAGE_01_159: [If an AMQP value has been set as message body on the source message it shall be cloned by calling `amqpvalue_clone`. ]*/
@@ -1015,49 +1038,60 @@ int message_add_body_amqp_data(MESSAGE_HANDLE message, BINARY_DATA amqp_data)
             LogError("Body type already set");
             result = MU_FAILURE;
         }
         else
         {
-            /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
-            BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, sizeof(BODY_AMQP_DATA) * (message->body_amqp_data_count + 1));
-            if (new_body_amqp_data_items == NULL)
+            size_t realloc_size = safe_add_size_t(message->body_amqp_data_count, 1);
+            realloc_size = safe_multiply_size_t(sizeof(BODY_AMQP_DATA), realloc_size);
+
+            if (realloc_size == SIZE_MAX)
             {
-                /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
-                LogError("Cannot allocate memory for body AMQP data items");
+                LogError("Invalid size for new_body_amqp_data_items");
                 result = MU_FAILURE;
             }
             else
             {
-                message->body_amqp_data_items = new_body_amqp_data_items;
-
-                if (amqp_data.length == 0)
+                /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
+                BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, realloc_size);
+                if (new_body_amqp_data_items == NULL)
                 {
-                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
-                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
-                    message->body_amqp_data_count++;
-
-                    /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
-                    result = 0;
+                    /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
+                    LogError("Cannot allocate memory for body AMQP data items");
+                    result = MU_FAILURE;
                 }
                 else
                 {
-                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
-                    if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
-                    {
-                        /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
-                        LogError("Cannot allocate memory for body AMQP data to be added");
-                        result = MU_FAILURE;
-                    }
-                    else
+                    message->body_amqp_data_items = new_body_amqp_data_items;
+
+                    if (amqp_data.length == 0)
                     {
-                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
-                        (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
+                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
+                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
                         message->body_amqp_data_count++;
 
                         /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
                         result = 0;
                     }
+                    else
+                    {
+                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
+                        if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
+                        {
+                            /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
+                            LogError("Cannot allocate memory for body AMQP data to be added");
+                            result = MU_FAILURE;
+                        }
+                        else
+                        {
+                            message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
+                            (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
+                            message->body_amqp_data_count++;
+
+                            /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
+                            result = 0;
+                        }
+                    }
                 }
             }
         }
     }
 
@@ -1248,37 +1282,49 @@ int message_add_body_amqp_sequence(MESSAGE_HANDLE message, AMQP_VALUE sequence_l
             LogError("Body is already set to another body type");
             result = MU_FAILURE;
         }
         else
         {
-            AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, sizeof(AMQP_VALUE) * (message->body_amqp_sequence_count + 1));
-            if (new_body_amqp_sequence_items == NULL)
+            size_t realloc_size = safe_add_size_t(message->body_amqp_sequence_count, 1);
+            realloc_size = safe_multiply_size_t(sizeof(AMQP_VALUE), realloc_size);
+
+            if (realloc_size == SIZE_MAX)
             {
-                /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
-                LogError("Cannot allocate enough memory for sequence items");
+                LogError("Invalid size for new_body_amqp_sequence_items");
                 result = MU_FAILURE;
             }
             else
             {
-                message->body_amqp_sequence_items = new_body_amqp_sequence_items;
+                AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, realloc_size);
 
-                /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
-                /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
-                message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
-                if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
+                if (new_body_amqp_sequence_items == NULL)
                 {
-                    /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
-                    LogError("Cloning sequence failed");
+                    /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
+                    LogError("Cannot allocate enough memory for sequence items");
                     result = MU_FAILURE;
                 }
                 else
                 {
-                    /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
-                    message->body_amqp_sequence_count++;
+                    message->body_amqp_sequence_items = new_body_amqp_sequence_items;
 
-                    /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
-                    result = 0;
+                    /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
+                    /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
+                    message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
+                    if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
+                    {
+                        /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
+                        LogError("Cloning sequence failed");
+                        result = MU_FAILURE;
+                    }
+                    else
+                    {
+                        /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
+                        message->body_amqp_sequence_count++;
+
+                        /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
+                        result = 0;
+                    }
                 }
             }
         }
     }
 

Vulnerable code:                 size_t i;
                result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, (source_message->body_amqp_data_count * sizeof(BODY_AMQP_DATA)));
                if (result->body_amqp_data_items == NULL)
                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                    LogError("Cannot allocate memory for body data sections");
                    message_destroy(result);
                    for (i = 0; i < source_message->body_amqp_data_count; i++)
                        result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;
                        /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
                        result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
                        if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
                            LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
                            break;
                        else
                            (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);

                    result->body_amqp_data_count = i;
                    if (i < source_message->body_amqp_data_count)
                    {
                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                        message_destroy(result);
                        result = NULL;
                    }
                size_t i;
                result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, (source_message->body_amqp_sequence_count * sizeof(AMQP_VALUE)));
                if (result->body_amqp_sequence_items == NULL)
                    /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                    LogError("Cannot allocate memory for body AMQP sequences");
                    for (i = 0; i < source_message->body_amqp_sequence_count; i++)
                    {
                        /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
                        result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
                        if (result->body_amqp_sequence_items[i] == NULL)
                        {
                            LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
                            break;
                        }
                    }

                    result->body_amqp_sequence_count = i;
                    if (i < source_message->body_amqp_sequence_count)
                }
            /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
            BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, sizeof(BODY_AMQP_DATA) * (message->body_amqp_data_count + 1));
            if (new_body_amqp_data_items == NULL)
                /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                LogError("Cannot allocate memory for body AMQP data items");
                message->body_amqp_data_items = new_body_amqp_data_items;

                if (amqp_data.length == 0)
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
                    message->body_amqp_data_count++;

                    /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
                    result = 0;
                    message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
                    if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
                    {
                        /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                        LogError("Cannot allocate memory for body AMQP data to be added");
                        result = MU_FAILURE;
                    }
                    else
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
                        (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
            AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, sizeof(AMQP_VALUE) * (message->body_amqp_sequence_count + 1));
            if (new_body_amqp_sequence_items == NULL)
                /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                LogError("Cannot allocate enough memory for sequence items");
                message->body_amqp_sequence_items = new_body_amqp_sequence_items;
                /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
                /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
                message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
                if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
                    /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                    LogError("Cloning sequence failed");
                    /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
                    message->body_amqp_sequence_count++;
                    /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
                    result = 0;
Fixed code: #include "azure_c_shared_utility/safe_math.h"
                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_data_count, sizeof(BODY_AMQP_DATA));
                if (calloc_size == SIZE_MAX)
                    LogError("Invalid size for body_amqp_data_items");
                    result->body_amqp_data_items = (BODY_AMQP_DATA*)calloc(1, calloc_size);

                    if (result->body_amqp_data_items == NULL)
                        /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                        LogError("Cannot allocate memory for body data sections");
                        message_destroy(result);
                        result = NULL;
                    }
                    else
                    {
                        size_t i;
                        for (i = 0; i < source_message->body_amqp_data_count; i++)
                            result->body_amqp_data_items[i].body_data_section_length = source_message->body_amqp_data_items[i].body_data_section_length;

                            /* Codes_SRS_MESSAGE_01_011: [If an AMQP data has been set as message body on the source message it shall be cloned by allocating memory for the binary payload.] */
                            result->body_amqp_data_items[i].body_data_section_bytes = (unsigned char*)malloc(source_message->body_amqp_data_items[i].body_data_section_length);
                            if (result->body_amqp_data_items[i].body_data_section_bytes == NULL)
                            {
                                LogError("Cannot allocate memory for body data section %u", (unsigned int)i);
                                break;
                            }
                            else
                            {
                                (void)memcpy(result->body_amqp_data_items[i].body_data_section_bytes, source_message->body_amqp_data_items[i].body_data_section_bytes, result->body_amqp_data_items[i].body_data_section_length);
                            }

                        result->body_amqp_data_count = i;
                        if (i < source_message->body_amqp_data_count)
                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                            message_destroy(result);
                            result = NULL;
                size_t calloc_size = safe_multiply_size_t(source_message->body_amqp_sequence_count, sizeof(AMQP_VALUE));
                if (calloc_size == SIZE_MAX)
                    LogError("Invalid size for body_amqp_sequence_items");
                    result->body_amqp_sequence_items = (AMQP_VALUE*)calloc(1, calloc_size);
                    if (result->body_amqp_sequence_items == NULL)
                        LogError("Cannot allocate memory for body AMQP sequences");
                    else
                    {
                        size_t i;

                        for (i = 0; i < source_message->body_amqp_sequence_count; i++)
                        {
                            /* Codes_SRS_MESSAGE_01_160: [ If AMQP sequences are set as AMQP body they shall be cloned by calling `amqpvalue_clone`. ] */
                            result->body_amqp_sequence_items[i] = amqpvalue_clone(source_message->body_amqp_sequence_items[i]);
                            if (result->body_amqp_sequence_items[i] == NULL)
                            {
                                LogError("Cannot clone AMQP sequence %u", (unsigned int)i);
                                break;
                            }
                        }

                        result->body_amqp_sequence_count = i;
                        if (i < source_message->body_amqp_sequence_count)
                        {
                            /* Codes_SRS_MESSAGE_01_012: [ If any cloning operation for the members of the source message fails, then `message_clone` shall fail and return NULL. ]*/
                            message_destroy(result);
                            result = NULL;
                        }
                    }
				}
            size_t realloc_size = safe_add_size_t(message->body_amqp_data_count, 1);
            realloc_size = safe_multiply_size_t(sizeof(BODY_AMQP_DATA), realloc_size);

            if (realloc_size == SIZE_MAX)
                LogError("Invalid size for new_body_amqp_data_items");
                /* Codes_SRS_MESSAGE_01_086: [ `message_add_body_amqp_data` shall add the contents of `amqp_data` to the list of AMQP data values for the body of the message identified by `message`. ]*/
                BODY_AMQP_DATA* new_body_amqp_data_items = (BODY_AMQP_DATA*)realloc(message->body_amqp_data_items, realloc_size);
                if (new_body_amqp_data_items == NULL)
                    /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                    LogError("Cannot allocate memory for body AMQP data items");
                    result = MU_FAILURE;
                    message->body_amqp_data_items = new_body_amqp_data_items;

                    if (amqp_data.length == 0)
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = NULL;
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = 0;
                    else
                    {
                        message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes = (unsigned char*)malloc(amqp_data.length);
                        if (message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes == NULL)
                        {
                            /* Codes_SRS_MESSAGE_01_153: [ If allocating memory to store the added AMQP data fails, `message_add_body_amqp_data` shall fail and return a non-zero value. ]*/
                            LogError("Cannot allocate memory for body AMQP data to be added");
                            result = MU_FAILURE;
                        }
                        else
                        {
                            message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_length = amqp_data.length;
                            (void)memcpy(message->body_amqp_data_items[message->body_amqp_data_count].body_data_section_bytes, amqp_data.bytes, amqp_data.length);
                            message->body_amqp_data_count++;

                            /* Codes_SRS_MESSAGE_01_087: [ On success it shall return 0. ]*/
                            result = 0;
                        }
                    }
            size_t realloc_size = safe_add_size_t(message->body_amqp_sequence_count, 1);
            realloc_size = safe_multiply_size_t(sizeof(AMQP_VALUE), realloc_size);

            if (realloc_size == SIZE_MAX)
                LogError("Invalid size for new_body_amqp_sequence_items");
                AMQP_VALUE* new_body_amqp_sequence_items = (AMQP_VALUE*)realloc(message->body_amqp_sequence_items, realloc_size);
                if (new_body_amqp_sequence_items == NULL)
                    /* Codes_SRS_MESSAGE_01_158: [ If allocating memory in order to store the sequence fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                    LogError("Cannot allocate enough memory for sequence items");
                    message->body_amqp_sequence_items = new_body_amqp_sequence_items;
                    /* Codes_SRS_MESSAGE_01_110: [ `message_add_body_amqp_sequence` shall add the contents of `sequence` to the list of AMQP sequences for the body of the message identified by `message`. ]*/
                    /* Codes_SRS_MESSAGE_01_156: [ The AMQP sequence shall be cloned by calling `amqpvalue_clone`. ]*/
                    message->body_amqp_sequence_items[message->body_amqp_sequence_count] = amqpvalue_clone(sequence_list);
                    if (message->body_amqp_sequence_items[message->body_amqp_sequence_count] == NULL)
                    {
                        /* Codes_SRS_MESSAGE_01_157: [ If `amqpvalue_clone` fails, `message_add_body_amqp_sequence` shall fail and return a non-zero value. ]*/
                        LogError("Cloning sequence failed");
                        result = MU_FAILURE;
                    }
                    else
                    {
                        /* Codes_SRS_MESSAGE_01_114: [ If adding the AMQP sequence fails, the previous value shall be preserved. ]*/
                        message->body_amqp_sequence_count++;

                        /* Codes_SRS_MESSAGE_01_111: [ On success it shall return 0. ]*/
                        result = 0;
                    }