1667
However, this code contains an off-by-one calculation error (CWE-193). It allocates exactly enough
space to contain the specified number of widgets, but it does not include the space for the NULL
pointer. As a result, the allocated buffer is smaller than it is supposed to be (CWE-131). So if
the user ever requests MAX_NUM_WIDGETS, there is an out-of-bounds write (CWE-787) when
the NULL is assigned. Depending on the environment and compilation settings, this could cause
memory corruption.
Example 7:
The following is an example of code that may result in a buffer underwrite. This code is attempting
to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by
using the function strstr(), which returns a pointer to the found substring in destBuf. Using pointer
arithmetic, the starting index of the substring is found.
Example Language: C (Bad)
int main() {
...
char *result = strstr(destBuf, "Replace Me");
int idx = result - destBuf;
strcpy(&destBuf[idx], srcBuf);
...
}
In the case where the substring is not found in destBuf, strstr() will return NULL, causing the
pointer arithmetic to be undefined, potentially setting the value of idx to a negative number. If idx is
negative, this will result in a buffer underwrite of destBuf.
Observed Examples
Reference Description
CVE-2021-21220 Chain: insufficient input validation (CWE-20) in browser allows heap corruption
(CWE-787), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21220
CVE-2021-28664 GPU kernel driver allows memory corruption because a user can obtain read/
write access to read-only pages, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-28664
CVE-2020-17087 Chain: integer truncation (CWE-197) causes small buffer allocation (CWE-131)
leading to out-of-bounds write (CWE-787) in kernel pool, as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-17087
CVE-2020-1054 Out-of-bounds write in kernel-mode driver, as exploited in the wild per CISA
KEV.
https://www.cve.org/CVERecord?id=CVE-2020-1054
CVE-2020-0041 Escape from browser sandbox using out-of-bounds write due to incorrect
bounds check, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-0041
CVE-2020-0968 Memory corruption in web browser scripting engine, as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-0968
CVE-2020-0022 chain: mobile phone Bluetooth implementation does not include offset
when calculating packet length (CWE-682), leading to out-of-bounds write
(CWE-787)
https://www.cve.org/CVERecord?id=CVE-2020-0022
CVE-2019-1010006Chain: compiler optimization (CWE-733) removes or modifies code used to
detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).
https://www.cve.org/CVERecord?id=CVE-2019-1010006
CVE-2009-1532 malformed inputs cause accesses of uninitialized or previously-deleted objects,
leading to memory corruption
CWE Version 4.14
CWE-787: Out-of-bounds Write
CWE-787: Out-of-bounds Write