1618
}
This example creates a situation where data can be dumped to a file on the local file system
without any limits on the size of the file. This could potentially exhaust file or disk resources and/or
limit other clients' ability to access the service.
Example 3:
In the following example, the processMessage method receives a two dimensional character array
containing the message to be processed. The two-dimensional character array contains the length
of the message in the first character array and the message body in the second character array.
The getMessageLength method retrieves the integer value of the length from the first character
array. After validating that the message length is greater than zero, the body character array
pointer points to the start of the second character array of the two-dimensional character array and
memory is allocated for the new body character array.
Example Language: C (Bad)
/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be
processed */
int processMessage(char **message)
{
char *body;
int length = getMessageLength(message[0]);
if (length > 0) {
body = &message[1][0];
processMessageBody(body);
return(SUCCESS);
}
else {
printf("Unable to process message; invalid message length");
return(FAIL);
}
}
This example creates a situation where the length of the body character array can be very large
and will consume excessive memory, exhausting system resources. This can be avoided by
restricting the length of the second character array with a maximum length check
Also, consider changing the type from 'int' to 'unsigned int', so that you are always guaranteed
that the number is positive. This might not be possible if the protocol specifically requires allowing
negative values, or if you cannot control the return value from getMessageLength(), but it could
simplify the check to ensure the input is positive, and eliminate other errors such as signed-tounsigned
conversion errors (CWE-195) that may occur elsewhere in the code.
Example Language: C (Good)
unsigned int length = getMessageLength(message[0]);
if ((length > 0) && (length < MAX_LENGTH)) {...}
Example 4:
In the following example, a server object creates a server socket and accepts client connections to
the socket. For every client connection to the socket a separate thread object is generated using
the ClientSocketThread class that handles request made by the client through the socket.
Example Language: Java (Bad)
public void acceptConnections() {
try {
ServerSocket serverSocket = new ServerSocket(SERVER_PORT);
int counter = 0;
boolean hasConnections = true;
CWE Version 4.14
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-770: Allocation of Resources Without Limits or Throttling