Integer overflow in apps/speed.c #16899
Description
In speed.c, the option multi can be specified through command line:
Line 1592 in 0ad7578
The value of multi is not sanitized and passed directly into do_multi:
Line 1809 in 0ad7578
which is then used as size for memory allocation:
Line 3472 in 0ad7578
By specifying multi (e.g., making it very large), one can trigger a signed integer overflow during the computation of the allocation size, which is a bug and can be dangerous.