788
References
[REF-961]Object Management Group (OMG). "Automated Source Code Reliability Measure
(ASCRM)". 2016 January. < http://www.omg.org/spec/ASCRM/1.0/ >.
CWE-789: Memory Allocation with Excessive Size Value
Weakness ID : 789
Structure : Simple
Abstraction : Variant
Description
The product allocates memory based on an untrusted, large size value, but it does not ensure that
the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 770 Allocation of Resources Without Limits or Throttling 1613
PeerOf 1325 Improperly Controlled Sequential Memory Allocation 2210
CanFollow 129 Improper Validation of Array Index 341
CanFollow 1284 Improper Validation of Specified Quantity in Input 2130
CanPrecede 476 NULL Pointer Dereference 1132
Weakness Ordinalities
Primary :
Resultant :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Language : Not Language-Specific (Prevalence = Undetermined)
Alternate Terms
Stack Exhaustion : When a weakness allocates excessive memory on the stack, it is often
described as "stack exhaustion," which is a technical impact of the weakness. This technical impact
is often encountered as a consequence of CWE-789 and/or CWE-1325.
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Memory)
Not controlling memory allocation can result in a request
for too much system memory, possibly leading to a crash
of the application due to out-of-memory conditions, or the
consumption of a large amount of memory on the system.
CWE Version 4.14
CWE-789: Memory Allocation with Excessive Size Value
CWE-789: Memory Allocation with Excessive Size Value