tree 9940564a653ffa1a2425fb457a490524d5f37af4
parent e65a8cbf6191f5b56ece6e49c6715b63e2e897c7
author Abseil Team <absl-team@google.com> 1783550221 -0700
committer Copybara-Service <copybara-worker@google.com> 1783550270 -0700

Avoid integer overflow & stack buffer overrun in ConvertStringArg (called from StrFormat())

The FixedArray size allocated is a multiple of the given buffer size, but this multiplication is not checked. It can potentially overflow and result in a small size that gets placed on the stack, thus resulting in a stack buffer overrun.

PiperOrigin-RevId: 944737638
Change-Id: Ib98028f3546c10b00447cd8f253a85786b647249