484
Effectiveness = High
Potential Mitigations
Phase: Requirements
A language which throws exceptions on ambiguous data casts might be chosen.
Phase: Architecture and Design
Design objects and program flow such that multiple or complex casts are unnecessary
Phase: Implementation
Ensure that any data type casting that you must used is entirely understood in order to reduce
the plausibility of error in use.
Demonstrative Examples
Example 1:
The following code is intended to read an incoming packet from a socket and extract one or more
headers.
Example Language: C (Bad)
DataPacket *packet;
int numHeaders;
PacketHeader *headers;
sock=AcceptSocketConnection();
ReadPacket(packet, sock);
numHeaders =packet->headers;
if (numHeaders > 100) {
ExitError("too many headers!");
}
headers = malloc(numHeaders * sizeof(PacketHeader);
ParsePacketHeaders(packet, headers);
The code performs a check to make sure that the packet does not contain too many headers.
However, numHeaders is defined as a signed int, so it could be negative. If the incoming packet
specifies a value such as -3, then the malloc calculation will generate a negative number (say,
-300 if each header can be a maximum of 100 bytes). When this result is provided to malloc(), it is
first converted to a size_t type. This conversion then produces a large value such as 4294966996,
which may cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195).
With the appropriate negative numbers, an attacker could trick malloc() into using a very small
positive number, which then allocates a buffer that is much smaller than expected, potentially
leading to a buffer overflow.
Example 2:
The following code reads a maximum size and performs validation on that size. It then performs a
strncpy, assuming it will not exceed the boundaries of the array. While the use of "short s" is forced
in this particular example, short int's are frequently used within real-world code, such as code that
processes structured data.
Example Language: C (Bad)
int GetUntrustedInt () {
return(0x0000FFFF);
}
void main (int argc, char **argv) {
char path[256];
char *input;
int i;
short s;
unsigned int sz;
i = GetUntrustedInt();
CWE Version 4.14
CWE-192: Integer Coercion Error
CWE-192: Integer Coercion Error