Local denial of service via ps integer overflow

Heap-based buffer overflow in procps-ng ps 4.0.3 and earlier allows local users to crash ps via an oversized -C argument. The parse_list function multiplies the argument length by the selection-element size without checking for integer overflow, allocates an undersized heap buffer, and then copies data beyond that allocation with strncpy. A low-privileged local account must be able to execute ps with an extremely large argument; the documented consequence is interruption of that ps process, not kernel compromise.