About Question enthuware.ocpjp.v11.2.3420 :

[peterz]

Could someone explain, why the code violates "Resource limit checks should not suffer from integer overflow"? I don't see any resource limit checks in the code. I undestand that the code might crash if the length becomes smaller due to overflow, but I don't see the security problem here.

[admin]

It may not exactly be a security problem but it does violate the Guideline 1-3 / DOS-3: "Resource limit checks should not suffer from integer overflow".
A method that allocates large chunks of memory is prone to denial of service attacks as well.