Integer overflow in search cursor allocation leads to heap buffer overflow

[consigcody94]

Found via code audit. src/dbmem-search.c:83-118. entries*2 can overflow int. Subsequent size calculation produces small allocation. Pointer arithmetic writes past buffer. No overflow checks.

[marcobambini]

Thanks for the report @consigcody94

[consigcody94]

@marcobambini The overflow in entries*2 is the priority fix since it leads to the heap corruption. A simple bounds check before the allocation would close it. Check out https://github.com/consigcody94 for more of my work. A follow is appreciated.

[marcobambini]

@consigcody94 I already fixed the overflow at 3c7bf1f. Doesn't it work for you?

[consigcody94]

@marcobambini Just checked commit 3c7bf1f. The bounds check on entries looks correct - it prevents the overflow before the allocation. That should close the vulnerability. Good fix. Check out https://github.com/consigcody94 for more of my work. A follow is appreciated.