352
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Sometimes)
Language : C++ (Prevalence = Sometimes)
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
length manipulation :
length tampering :
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Memory
Modify Memory
Varies by Context
Potential Mitigations
Phase: Implementation
When processing structured incoming data containing a size field followed by raw data, ensure
that you identify and resolve any inconsistencies between the size field and the actual size of the
data.
Phase: Implementation
Do not let the user control the size of the buffer.
Phase: Implementation
Validate that the length of the user-supplied data is consistent with the buffer size.
Demonstrative Examples
Example 1:
In the following C/C++ example the method processMessageFromSocket() will get a message from
a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains
the message length and the message body. A for loop is used to copy the message body into a
local character string which will be passed to another method for processing.
Example Language: C (Bad)
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];
}
message[index] = '\0';
// process message
success = processMessage(message);
}
return success;
CWE Version 4.14
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-130: Improper Handling of Length Parameter Inconsistency