1115
Example Language: C (Bad)
int *p = x;
char * second_char = (char *)(p + 1);
In this example, second_char is intended to point to the second byte of p. But, adding 1 to p
actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms).
If the resulting memory address is read, this could potentially be an information leak. If it is a
write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer
overflow. Note that the above code may also be wrong in other ways, particularly in a little endian
environment.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 737 CERT C Secure Coding Standard (2008) Chapter 4 -
Expressions (EXP)
734 2341
MemberOf 884 CWE Cross-section 884 2567
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays
(ARR)
1154 2457
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Unintentional pointer scaling
CERT C Secure Coding ARR39-
C
Exact Do not add or subtract a scaled integer
to a pointer
CERT C Secure Coding EXP08-C Ensure pointer arithmetic is used
correctly
Software Fault Patterns SFP1 Glitch in computation
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-469: Use of Pointer Subtraction to Determine Size
Weakness ID : 469
Structure : Simple
Abstraction : Base
Description
The product subtracts one pointer from another in order to determine size, but this calculation can
be incorrect if the pointers do not exist in the same memory chunk.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-469: Use of Pointer Subtraction to Determine Size
CWE-469: Use of Pointer Subtraction to Determine Size