
istic lengths.The multiplication integer wrapping bug in Example 11.8 is very similar to
the addition integer wrapping bug.
Example 11.8 Multiplication-Based Integer Wrapping
1 #include <stdio.h>
2 #include <stdlib.h>
3
4
int main(void)
5 {
6 unsigned int i, length1, length2;
7 char *buf;
8
9
// ((0xffffffff)/5) 32-bit unsigned integer value in hex, 1073741824 in decimal
10 length1 = 0x33333333;
11 length2 = 0x5;
12
13
// allocate enough memory for the length plus the one null byte
14 buf = (char *)malloc((length1*length2)+1);
15
16
// print the length in hex and the contents of the buffer
17 printf("length1: %x\tlength2: %x\ttotal: %x\tbuf: %s\n", length1, length2, ...