#2 Potential Integer Overflow vulnerability in src/celeste/svm.cpp

[Anonymous]

There seems to be potential integer overflow vulnerability in src/celeste/svm.cpp.
In line 2862, model->nr_class is read from external source.

(2862) FSCANF(fp,"%d",&model->nr_class);
...
(2867) int n = model->nr_class * (model->nr_class-1)/2;
(2868) model->rho = Malloc(double,n);

If model->nr_class is a large integer that can cause integer overflow in line 2867,
allocation of memory on 2868 may happen with unexpected value.