5
5
<overview >
6
6
7
7
<p >Allocating memory with a size based on user input may allow arbitrary amounts of memory to be
8
- allocated, leading to a crash or denial of service incident .</p >
8
+ allocated, leading to a crash or a denial-of- service (DoS) attack .</p >
9
9
10
10
<p >If the user input is multiplied by a constant, such as the size of a type, the result may
11
- overflow. In a build with the <code >--release</code > flag Rust performs two's complement wrapping,
12
- with the result that less memory may be allocated than expected . This can lead to buffer overflow
11
+ overflow. In a build with the <code >--release</code > flag, Rust performs two's complement wrapping,
12
+ with the result that less memory than expected may be allocated. This can lead to buffer overflow
13
13
incidents.</p >
14
14
15
15
</overview >
@@ -24,12 +24,12 @@ does not wrap around.</p>
24
24
<example >
25
25
26
26
<p >In the following example, an arbitrary amount of memory is allocated based on user input. In
27
- addition, due to the multiplication operation the result may overflow if a very large value is
28
- provided, leading to less memory being allocated than other parts of the program expect .</p >
27
+ addition, due to the multiplication operation, the result may overflow if a very large value is
28
+ provided. This may lead to less memory being allocated than expected by other parts of the program.</p >
29
29
<sample src =" UncontrolledAllocationSizeBad.rs" />
30
30
31
- <p >In the fixed example, the user input is checked against a maximum value. If the check fails an
32
- error is returned, and both the multiplication and alloaction do not take place.</p >
31
+ <p >In the fixed example, the user input is checked against a maximum value. If the check fails, an
32
+ error is returned, and both the multiplication and allocation do not take place.</p >
33
33
<sample src =" UncontrolledAllocationSizeGood.rs" />
34
34
35
35
</example >
0 commit comments