1660
Example 2:
The following example asks a user for an offset into an array to select an item.
Example Language: C (Bad)
int main (int argc, char **argv) {
char *items[] = {"boat", "car", "truck", "train"};
int index = GetUntrustedOffset();
printf("You selected %s\n", items[index-1]);
}
The programmer allows the user to specify which element in the list to select, however an attacker
can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126).
Example 3:
The following is an example of code that may result in a buffer underwrite. This code is attempting
to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by
using the function strstr(), which returns a pointer to the found substring in destBuf. Using pointer
arithmetic, the starting index of the substring is found.
Example Language: C (Bad)
int main() {
...
char *result = strstr(destBuf, "Replace Me");
int idx = result - destBuf;
strcpy(&destBuf[idx], srcBuf);
...
}
In the case where the substring is not found in destBuf, strstr() will return NULL, causing the
pointer arithmetic to be undefined, potentially setting the value of idx to a negative number. If idx is
negative, this will result in a buffer underwrite of destBuf.
Observed Examples
Reference Description
CVE-2002-2227 Unchecked length of SSLv2 challenge value leads to buffer underflow.
https://www.cve.org/CVERecord?id=CVE-2002-2227
CVE-2007-4580 Buffer underflow from a small size value with a large buffer (length parameter
inconsistency, CWE-130)
https://www.cve.org/CVERecord?id=CVE-2007-4580
CVE-2007-1584 Buffer underflow from an all-whitespace string, which causes a counter to be
decremented before the buffer while looking for a non-whitespace character.
https://www.cve.org/CVERecord?id=CVE-2007-1584
CVE-2007-0886 Buffer underflow resultant from encoded data that triggers an integer overflow.
https://www.cve.org/CVERecord?id=CVE-2007-0886
CVE-2006-6171 Product sets an incorrect buffer size limit, leading to "off-by-two" buffer
underflow.
https://www.cve.org/CVERecord?id=CVE-2006-6171
CVE-2006-4024 Negative value is used in a memcpy() operation, leading to buffer underflow.
https://www.cve.org/CVERecord?id=CVE-2006-4024
CVE-2004-2620 Buffer underflow due to mishandled special characters
https://www.cve.org/CVERecord?id=CVE-2004-2620
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-787: Out-of-bounds Write
CWE-787: Out-of-bounds Write