operator new has an implicit *sizeof(type), and during that operation there can occur an integer overflow. Example: int* foo() { return new int[0x40000000]; } Compiled for a 32-bit target, this allocates 0 bytes. Most compilers do not detect this either, but the Microsoft compiler instead generates code that in case of overflow generates an allocation for 0xffffffff bytes that will then fail. g++ should also do that. It catches many subtle security bugs, and it costs much less than for example -fstack-protector, which everyone agrees is a great idea.
There is no overflow here really as sizeof is unsigned and unsigned types don't overflow, they wrap. *** This bug has been marked as a duplicate of 19351 ***