Symantec AntiVirus - TNEF Decoder Integer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=819 Simple fuzzing found an integer overflow in the dec2tnef library. This allocation from Attachment::setDataFromAttachment doesn't verify that the attacker controlled value doesn't wrap: .text:000227B8 8D 42 01 lea eax, edx+1...