CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Description

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Potential Impact

Demonstrative Examples

void host_lookup(char *user_supplied_addr){
                        struct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);
                           
                           /*routine that ensures user_supplied_addr is in the right format for conversion */
                           
                           validate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);
                     }

char * copy_input(char *user_supplied_string){
                        int i, dst_index;char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);if ( MAX_SIZE <= strlen(user_supplied_string) ){die("user string too long, die evil hacker!");}dst_index = 0;for ( i = 0; i < strlen(user_supplied_string); i++ ){
                              if( '&' == user_supplied_string[i] ){dst_buf[dst_index++] = '&';dst_buf[dst_index++] = 'a';dst_buf[dst_index++] = 'm';dst_buf[dst_index++] = 'p';dst_buf[dst_index++] = ';';}else if ('<' == user_supplied_string[i] ){
                                       /* encode to &lt; */
                                       
                                 }else dst_buf[dst_index++] = user_supplied_string[i];
                           }return dst_buf;
                     }

int main (int argc, char **argv) {char *items[] = {"boat", "car", "truck", "train"};int index = GetUntrustedOffset();printf("You selected %s\n", items[index-1]);}

int getValueFromArray(int *array, int len, int index) {
                        
                           int value;
                           
                           // check that the array index is less than the maximum
                           
                           
                           // length of the array
                           if (index < len) {
                              
                                 // get the value at the specified index of the array
                                 value = array[index];
                           }
                           // if array index is invalid then output error message
                           
                           // and return value indicating error
                           else {printf("Value is: %d\n", array[index]);value = -1;}
                           return value;
                     }

...
                     
                     // check that the array index is within the correct
                     
                     
                     // range of values for the array
                     if (index >= 0 && index < len) {
                     ...

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives. Automated static analysis generally does not account for environmental considerations when
• Automated Dynamic Analysis — This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash
• Automated Dynamic Analysis Moderate — Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
• Automated Static Analysis - Binary or Bytecode SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
• Manual Static Analysis - Binary or Bytecode SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
• Dynamic Analysis with Automated Results Interpretation SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:

Real-World CVE Examples

Showing 15 of 19 observed examples.

Related Weaknesses

Taxonomy Mappings

• OWASP Top Ten 2004: A5 — Buffer Overflows
• CERT C Secure Coding: ARR00-C — Understand how arrays work
• CERT C Secure Coding: ARR30-C — Do not form or use out-of-bounds pointers or array subscripts
• CERT C Secure Coding: ARR38-C — Guarantee that library functions do not form invalid pointers
• CERT C Secure Coding: ENV01-C — Do not make assumptions about the size of an environment variable
• CERT C Secure Coding: EXP39-C — Do not access a variable through a pointer of an incompatible type
• CERT C Secure Coding: FIO37-C — Do not assume character data has been read
• CERT C Secure Coding: STR31-C — Guarantee that storage for strings has sufficient space for character data and the null terminator
• CERT C Secure Coding: STR32-C — Do not pass a non-null-terminated character sequence to a library function that expects a string
• WASC: 7 — Buffer Overflow
• Software Fault Patterns: SFP8 — Faulty Buffer Access