operator new[] sometimes returns pointers to heap blocks which are too small. When a new array is allocated, the C++ run-time has to calculate its size. The product may exceed the maximum value which can be stored in a machine register. This error is ignored, and the truncated value is used for the heap allocation. This may lead to heap overflows and therefore security bugs. (See http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)

Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.

Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.

Integer overflow in the new[] operator in gcc before 4.8.0 allows atta ...

Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.