Passing a negative value into a memory allocation function can still result in a cleanly-allocated block of memory. However, it will likely be much, much larger than intended. This is because ``++alloc++``, ``++malloc++``, ``++calloc++``, and ``++realloc++`` take a ``++size_t++`` parameteter, which is unsigned. Pass in a negative value, and it will be converted to ``++SIZE_MAX - 1++``. According to the standard, ``++SIZE_MAX++`` must be at least 65,535.


Such an allocation could result in Denial of Service as the system struggles in the wake of the too-large memory grab. 


This rule logs an issue when a signed value is passed in to an allocation function.


== Noncompliant Code Example

----
char** addOne(char ** cpp, int len) {
  len++;
  return realloc(cpp, len * sizeof(char *));  // Noncompliant; negative in the case of overflow
}
----


== See

* http://cwe.mitre.org/data/definitions/131[MITRE, CWE-131] - Incorrect Calculation of Buffer Size
* https://www.sans.org/top25-software-errors/#cat2[SANS Top 25] - Risky Resource Management

