364
can be primary to resource consumption problems (CWE-400), including uncontrolled memory
allocation (CWE-789). However, its relationship with out-of-bounds buffer access (CWE-119)
must also be considered.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Other length calculation error
CERT C Secure Coding INT30-C Imprecise Ensure that unsigned integer
operations do not wrap
CERT C Secure Coding MEM35-
C
CWE More
Abstract
Allocate sufficient memory for an object
Related Attack Patterns
CAPEC-ID Attack Pattern Name
47 Buffer Overflow via Parameter Expansion
100 Overflow Buffers
References
[REF-106]David LeBlanc and Niels Dekker. "SafeInt". < http://safeint.codeplex.com/ >.
[REF-107]Jason Lam. "Top 25 Series - Rank 18 - Incorrect Calculation of Buffer Size". 2010 March
9. SANS Software Security Institute. < http://software-security.sans.org/blog/2010/03/19/top-25-
series-rank-18-incorrect-calculation-of-buffer-size >.
[REF-58]Michael Howard. "Address Space Layout Randomization in Windows Vista". < https://
learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-inwindows-
vista >.2023-04-07.
[REF-61]Microsoft. "Understanding DEP as a mitigation technology part 1". < https://
msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/
>.2023-04-07.
[REF-60]"PaX". < https://en.wikipedia.org/wiki/Executable_space_protection#PaX >.2023-04-07.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-64]Grant Murphy. "Position Independent Executables (PIE)". 2012 November 8. Red Hat. <
https://www.redhat.com/en/blog/position-independent-executables-pie >.2023-04-07.
[REF-1332]John Richard Moser. "Prelink and address space randomization". 2006 July 5. < https://
lwn.net/Articles/190139/ >.2023-04-26.
[REF-1333]Dmitry Evtyushkin, Dmitry Ponomarev, Nael Abu-Ghazaleh. "Jump Over ASLR:
Attacking Branch Predictors to Bypass ASLR". 2016. < http://www.cs.ucr.edu/~nael/pubs/
micro16.pdf >.2023-04-26.
[REF-1334]D3FEND. "Stack Frame Canary Validation (D3-SFCV)". 2023. < https://
d3fend.mitre.org/technique/d3f:StackFrameCanaryValidation/ >.2023-04-26.
[REF-1335]D3FEND. "Segment Address Offset Randomization (D3-SAOR)". 2023. < https://
d3fend.mitre.org/technique/d3f:SegmentAddressOffsetRandomization/ >.2023-04-26.
CWE Version 4.14
CWE-134: Use of Externally-Controlled Format String
CWE-134: Use of Externally-Controlled Format String