REDHAT-BUG-2453814: Integer Overflow

Integer overflow (wraparound) vulnerability in Corosync’s join message sanity validation in exec/totemsrp.c. The flaw is in checkmembjoinsanity(), where proclistentries and failedlistentries are attacker-controlled 32-bit unsigned values received from the network and are added together before being promoted to sizet. This allows the addition (proclistentries + failedlistentries) to wrap around in 32-bit arithmetic (e.g., 0x80000000 + 0x80000000 = 0), causing requiredlen to be calculated too small and allowing a short packet to pass validation. As a result, Corosync proceeds with processing malformed input that should have been rejected, which can be exploited remotely without authentication in totemudp/totemudpu mode via crafted UDP packets to crash the service, resulting in a denial of service.