497
/* if chunk info is valid, return the size of usable memory,
* else, return -1 to indicate an error
*/
...
}
int main() {
...
memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));
...
}
If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is
not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument
to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be
interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely
available to the destination buffer (CWE-787, CWE-788).
Example 6:
This example shows a typical attempt to parse a string with an error resulting from a difference in
assumptions between the caller to a function and the function's action.
Example Language: C (Bad)
int proc_msg(char *s, int msg_len)
{
// Note space at the end of the string - assume all strings have preamble with space
int pre_len = sizeof("preamble: ");
char buf[pre_len - msg_len];
... Do processing here if we get this far
}
char *s = "preamble: message\n";
char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space)
int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero length
int ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stack
The buffer length ends up being -1, resulting in a blown out stack. The space character after the
colon is included in the function calculation, but not in the caller's calculation. This, unfortunately, is
not usually so obvious but exists in an obtuse series of calculations.
Observed Examples
Reference Description
CVE-2007-4268 Chain: integer signedness error (CWE-195) passes signed comparison,
leading to heap overflow (CWE-122)
https://www.cve.org/CVERecord?id=CVE-2007-4268
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Signed to unsigned conversion error
CWE Version 4.14
CWE-196: Unsigned to Signed Conversion Error
CWE-196: Unsigned to Signed Conversion Error