Description
Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. If the table is later reallocated, then the wrong pointer could be freed.
References
- 93164 vdb-entry
- [oss-security] 20160922 CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" mailing-list
- https://github.com/weidai11/cryptopp/issues/302
- https://www.cryptopp.com/release565.html
- [oss-security] 20160923 Re: CVE Assignment for Crypto++ and "AES and incorrect argument to _freea() under Microsoft compilers" mailing-list