55<overview >
66
77<p >Allocating memory with a size based on user input may allow arbitrary amounts of memory to be
8- allocated, leading to a crash or denial of service incident .</p >
8+ allocated, leading to a crash or a denial-of- service (DoS) attack .</p >
99
1010<p >If the user input is multiplied by a constant, such as the size of a type, the result may
11- overflow. In a build with the <code >--release</code > flag Rust performs two's complement wrapping,
12- with the result that less memory may be allocated than expected . This can lead to buffer overflow
11+ overflow. In a build with the <code >--release</code > flag, Rust performs two's complement wrapping,
12+ with the result that less memory than expected may be allocated. This can lead to buffer overflow
1313incidents.</p >
1414
1515</overview >
@@ -24,12 +24,12 @@ does not wrap around.</p>
2424<example >
2525
2626<p >In the following example, an arbitrary amount of memory is allocated based on user input. In
27- addition, due to the multiplication operation the result may overflow if a very large value is
28- provided, leading to less memory being allocated than other parts of the program expect .</p >
27+ addition, due to the multiplication operation, the result may overflow if a very large value is
28+ provided. This may lead to less memory being allocated than expected by other parts of the program.</p >
2929<sample src =" UncontrolledAllocationSizeBad.rs" />
3030
31- <p >In the fixed example, the user input is checked against a maximum value. If the check fails an
32- error is returned, and both the multiplication and alloaction do not take place.</p >
31+ <p >In the fixed example, the user input is checked against a maximum value. If the check fails, an
32+ error is returned, and both the multiplication and allocation do not take place.</p >
3333<sample src =" UncontrolledAllocationSizeGood.rs" />
3434
3535</example >
0 commit comments