1117
The following example contains the method size that is used to determine the number of nodes in a
linked list. The method is passed a pointer to the head of the linked list.
Example Language: C (Bad)
struct node {
int data;
struct node* next;
};
// Returns the number of nodes in a linked list from
// the given pointer to the head of the list.
int size(struct node* head) {
struct node* current = head;
struct node* tail;
while (current != NULL) {
tail = current;
current = current->next;
}
return tail - head;
}
// other methods for manipulating the list
...
However, the method creates a pointer that points to the end of the list and uses pointer subtraction
to determine the number of nodes in the list by subtracting the tail pointer from the head pointer.
There no guarantee that the pointers exist in the same memory area, therefore using pointer
subtraction in this way could return incorrect results and allow other unintended behavior. In this
example a counter should be used to determine the number of nodes in the list, as shown in the
following code.
Example Language: C (Good)
...
int size(struct node* head) {
struct node* current = head;
int count = 0;
while (current != NULL) {
count++;
current = current->next;
}
return count;
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 740 CERT C Secure Coding Standard (2008) Chapter 7 -
Arrays (ARR)
734 2344
MemberOf 874 CERT C++ Secure Coding Section 06 - Arrays and the
STL (ARR)
868 2375
MemberOf 884 CWE Cross-section 884 2567
MemberOf 971 SFP Secondary Cluster: Faulty Pointer Use 888 2405
MemberOf 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays
(ARR)
1154 2457
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
Taxonomy Mappings
CWE Version 4.14
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470: Use of Externally-Controlled Input
to Select Classes or Code ('Unsafe Reflection') 1118
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Improper pointer subtraction
CERT C Secure Coding ARR36-
C
Exact Do not subtract or compare two
pointers that do not refer to the same
array
Software Fault Patterns SFP7 Faulty Pointer Use
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-470: Use of Externally-Controlled Input to Select Classes or Code
('Unsafe Reflection')
Weakness ID : 470
Structure : Simple
Abstraction : Base
Description
The product uses external input with reflection to select which classes or code to use, but it does
not sufficiently prevent the input from selecting improper classes or code.
Extended Description
If the product uses external inputs to determine which class to instantiate or which method to
invoke, then an attacker could supply values to select unexpected classes or methods. If this
occurs, then the attacker could create control flow paths that were not intended by the developer.
These paths could bypass authentication or access control checks, or otherwise cause the product
to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker
can upload files into a location that appears on the product's classpath (CWE-427) or add new
entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can
use reflection to introduce new, malicious behavior into the product.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 610 Externally Controlled Reference to a Resource in Another
Sphere