328
Scope Impact Likelihood
When the consequence is arbitrary code execution, this
can often be used to subvert any other security service.
Potential Mitigations
Phase: Requirements
Choose a language that is not susceptible to these issues.
Phase: Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to
ensure that they are within an expected range.
Demonstrative Examples
Example 1:
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character
string. The function copies the input string to a local character string and uses a while statement to
remove the trailing whitespace by moving backward through the string and overwriting whitespace
with a NUL character.
Example Language: C (Bad)
char* trimTrailingWhitespace(char *strMessage, int length) {
char *retMessage;
char *message = malloc(sizeof(char)*(length+1));
// copy input string to a temporary string
char message[length+1];
int index;
for (index = 0; index < length; index++) {
message[index] = strMessage[index];
}
message[index] = '\0';
// trim trailing whitespace
int len = index-1;
while (isspace(message[len])) {
message[len] = '\0';
len--;
}
// return string without trailing whitespace
retMessage = message;
return retMessage;
}
However, this function can cause a buffer underwrite if the input character string contains all
whitespace. On some systems the while statement will move backwards past the beginning of a
character string and will call the isspace() function on an address outside of the bounds of the local
buffer.
Example 2:
The following is an example of code that may result in a buffer underwrite. This code is attempting
to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by
using the function strstr(), which returns a pointer to the found substring in destBuf. Using pointer
arithmetic, the starting index of the substring is found.
Example Language: C (Bad)
int main() {
...
char *result = strstr(destBuf, "Replace Me");
int idx = result - destBuf;
strcpy(&destBuf[idx], srcBuf);
...
CWE Version 4.14
CWE-124: Buffer Underwrite ('Buffer Underflow')
CWE-124: Buffer Underwrite ('Buffer Underflow')