1657
Always specify output buffers large enough to handle the maximum-size possible result from
path manipulation functions.
Demonstrative Examples
Example 1:
In this example the function creates a directory named "output\<name>" in the current directory and
returns a heap-allocated copy of its name.
Example Language: C (Bad)
char *createOutputDirectory(char *name) {
char outputDirectoryName[128];
if (getCurrentDirectory(128, outputDirectoryName) == 0) {
return null;
}
if (!PathAppend(outputDirectoryName, "output")) {
return null;
}
if (!PathAppend(outputDirectoryName, name)) {
return null;
}
if (SHCreateDirectoryEx(NULL, outputDirectoryName, NULL) != ERROR_SUCCESS) {
return null;
}
return StrDup(outputDirectoryName);
}
For most values of the current directory and the name parameter, this function will work properly.
However, if the name parameter is particularly long, then the second call to PathAppend() could
overflow the outputDirectoryName buffer, which is smaller than MAX_PATH bytes.
Affected Resources
• Memory
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 972 SFP Secondary Cluster: Faulty String Expansion 888 2405
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Maintenance
This entry is at a much lower level of abstraction than most entries because it is function-specific.
It also has significant overlap with other entries that can vary depending on the perspective.
For example, incorrect usage could trigger either a stack-based overflow (CWE-121) or a heapbased
overflow (CWE-122). The CWE team has not decided how to handle such entries.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Often Misused: File System
Software Fault Patterns SFP9 Faulty String Expansion
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
CWE Version 4.14
CWE-786: Access of Memory Location Before Start of Buffer
CWE-786: Access of Memory Location Before Start of Buffer