CWE-130: Improper Handling of Length Parameter Inconsistency

Description

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.

Potential Impact

Demonstrative Examples

int processMessageFromSocket(int socket) {
                        int success;
                           char buffer[BUFFER_SIZE];char message[MESSAGE_SIZE];
                           
                           // get message from socket and store into buffer
                           
                           
                           //Ignoring possibliity that buffer > BUFFER_SIZE
                           if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
                              
                                 
                                 // place contents of the buffer into message structure
                                 ExMessage *msg = recastBuffer(buffer);
                                 
                                 // copy message body into string for processing
                                 int index;for (index = 0; index < msg->msgLength; index++) {message[index] = msg->msgBody[index];}message[index] = '\0';
                                 
                                 // process message
                                 success = processMessage(message);
                           }return success;
                     }

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Showing 15 of 25 observed examples.

Related Weaknesses

Taxonomy Mappings

• PLOVER: — Length Parameter Inconsistency
• Software Fault Patterns: SFP24 — Tainted Input to Command