1673
Example Language: C (Bad)
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];
}
message[index] = '\0';
// process message
success = processMessage(message);
}
return success;
}
However, the message length variable from the structure is used as the condition for ending the
for loop without validating that the message length variable accurately reflects the length of the
message body (CWE-606). This can result in a buffer over-read (CWE-125) by reading from
memory beyond the bounds of the buffer if the message length variable indicates a length that is
longer than the size of a message body (CWE-130).
Observed Examples
Reference Description
CVE-2009-2550 Classic stack-based buffer overflow in media player using a long entry in a
playlist
https://www.cve.org/CVERecord?id=CVE-2009-2550
CVE-2009-2403 Heap-based buffer overflow in media player using a long entry in a playlist
https://www.cve.org/CVERecord?id=CVE-2009-2403
CVE-2009-0689 large precision value in a format string triggers overflow
https://www.cve.org/CVERecord?id=CVE-2009-0689
CVE-2009-0558 attacker-controlled array index leads to code execution
https://www.cve.org/CVERecord?id=CVE-2009-0558
CVE-2008-4113 OS kernel trusts userland-supplied length value, allowing reading of sensitive
information
https://www.cve.org/CVERecord?id=CVE-2008-4113
CVE-2007-4268 Chain: integer signedness error (CWE-195) passes signed comparison,
leading to heap overflow (CWE-122)
https://www.cve.org/CVERecord?id=CVE-2007-4268
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1129 CISQ Quality Measures (2016) - Reliability 1128 2440
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Taxonomy Mappings
CWE Version 4.14
CWE-789: Memory Allocation with Excessive Size Value
CWE-789: Memory Allocation with Excessive Size Value