Integer overflow in fx_basic.h and fx_memory.h

core/include/fxcrt/fx_memory.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef _FX_MEMORY_H_
 #define _FX_MEMORY_H_
 #ifndef _FX_SYSTEM_H_
 #include "fx_system.h"
@@ skipping 99 matching lines @@
 {
 public:
 
     virtual ~CFX_DestructObject() {}
 };
 #ifdef __cplusplus
 extern "C" {
 #endif
 typedef struct _IFX_Allocator {
 
-    void*       (*m_AllocDebug)(struct _IFX_Allocator* pAllocator, size_t size, FX_LPCSTR file, int line);
+    void*       (*m_AllocDebug)(struct _IFX_Allocator* pAllocator, size_t num, size_t size, FX_LPCSTR file, int line);
 
-    void*       (*m_Alloc)(struct _IFX_Allocator* pAllocator, size_t size);
+    void*       (*m_Alloc)(struct _IFX_Allocator* pAllocator, size_t num, size_t size);
 
-    void*       (*m_ReallocDebug)(struct _IFX_Allocator* pAllocator, void* p, size_t size, FX_LPCSTR file, int line);
+    void*       (*m_ReallocDebug)(struct _IFX_Allocator* pAllocator, void* p, size_t num, size_t size, FX_LPCSTR file, int line);
 
-    void*       (*m_Realloc)(struct _IFX_Allocator* pAllocator, void* p, size_t size);
+    void*       (*m_Realloc)(struct _IFX_Allocator* pAllocator, void* p, size_t num, size_t size);
 
     void        (*m_Free)(struct _IFX_Allocator* pAllocator, void* p);
 } IFX_Allocator;
 IFX_Allocator* FXMEM_GetDefAllocator();
 #ifdef __cplusplus
 }
 #endif
 #ifdef _DEBUG
 
 #define FX_Allocator_Alloc(fxAllocator, type, size) \
-    ((fxAllocator) ? (type*)(fxAllocator)->m_AllocDebug((fxAllocator), (size) * sizeof(type), __FILE__, __LINE__) : (FX_Alloc(type, size)))
+    ((fxAllocator) ? (type*)(fxAllocator)->m_AllocDebug((fxAllocator), (size), sizeof(type), __FILE__, __LINE__) : (FX_Alloc(type, size)))
 
 #define FX_Allocator_Realloc(fxAllocator, type, ptr, new_size) \
-    ((fxAllocator) ? (type*)(fxAllocator)->m_ReallocDebug((fxAllocator), (ptr), (new_size) * sizeof(type), __FILE__, __LINE__) : (FX_Realloc(type, ptr, new_size)))
+    ((fxAllocator) ? (type*)(fxAllocator)->m_ReallocDebug((fxAllocator), (ptr), (new_size) , sizeof(type), __FILE__, __LINE__) : (FX_Realloc(type, ptr, new_size)))
 #else
 
 #define FX_Allocator_Alloc(fxAllocator, type, size) \
-    ((fxAllocator) ? (type*)(fxAllocator)->m_Alloc((fxAllocator), (size) * sizeof(type)) : (FX_Alloc(type, size)))
+    ((fxAllocator) ? (type*)(fxAllocator)->m_Alloc((fxAllocator), (size), sizeof(type)) : (FX_Alloc(type, size)))
 
 #define FX_Allocator_Realloc(fxAllocator, type, ptr, new_size) \
-    ((fxAllocator) ? (type*)(fxAllocator)->m_Realloc((fxAllocator), (ptr), (new_size) * sizeof(type)) : (FX_Realloc(type, ptr, new_size)))
+    ((fxAllocator) ? (type*)(fxAllocator)->m_Realloc((fxAllocator), (ptr), (new_size), sizeof(type)) : (FX_Realloc(type, ptr, new_size)))
 #endif
 #define FX_Allocator_Free(fxAllocator, ptr) \
     ((fxAllocator) ? (fxAllocator)->m_Free((fxAllocator), (ptr)) : (FX_Free(ptr)))
 inline void* operator new(size_t size, IFX_Allocator* fxAllocator)
 {
     return (void*)FX_Allocator_Alloc(fxAllocator, FX_BYTE, size);
 }
 inline void operator delete(void* ptr, IFX_Allocator* fxAllocator)
 {
 }
@@ skipping 133 matching lines @@
 
     size_t      nPageSize_Large;
 
     size_t      nPageSize_Alone;
 } FX_MEMCONFIG;
 void    FXMEM_SetConfig(const FX_MEMCONFIG* memConfig);
 #ifdef __cplusplus
 }
 #endif
 #endif