title: Vulnerability of malloc and memcpy
body: <pre><code>void *copy_elements(void *ele_src[], int ele_cnt, size_t ele_size) 
  { 
      /*
       * Allocate buffer for ele_cnt objects, each of ele_size bytes 
       * and copy from locations designated by ele_src
       */
  
      void *result = malloc(ele_cnt * ele_size); 
  
      if (result == NULL)
          /* malloc failed */
          return NULL; 
     
      void *next = result;
      int i;
  
      for (i = 0; i &lt; ele_cnt; i++) {
          /* Copy object i to destination */ 
          memcpy(next, ele_src[i], ele_size);
          /* Move pointer to next memory region */ 
          next += ele_size;
      }
  
      return result; 
  }
  </code></pre>
  <p>The above code has a vulnerability issue. Under some <code>ele_cnt</code> and <code>ele_size</code> values, the code might crash. I suspect it has to do with unsigned - signed conversion that happens with <code>malloc</code> and <code>memcpy</code> but I'm not sure how to exploit this properly. Any help would be thankful!</p>