ned14/nedmalloc — pull request #6 by xiw (2012-04-14 21:18:53+00:00)
Title: Overflow fixes

Hi,

This fixes two integer overflows when using calloc() and malloc(),
respectively, which could lead to buffer overflows.

- `calloc(n, size)`: `n * size` could overflow.

This happened to glibc a few years ago.

http://cert.uni-stuttgart.de/ticker/advisories/calloc.html

- `malloc(size)`: `size` could overflow after alignment.

This is dangerous if `size` is user-controlled.

size = /* read from input */;
p = malloc(size);
if (p) memcpy(p, src, size);