584
In the following C/C++ example the method processMessageFromSocket() will get a message from
a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains
the message length and the message body. A for loop is used to copy the message body into a
local character string which will be passed to another method for processing.
Example Language: C (Bad)
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];
}
message[index] = '\0';
// process message
success = processMessage(message);
}
return success;
}
However, the message length variable from the structure is used as the condition for ending the
for loop without validating that the message length variable accurately reflects the length of the
message body (CWE-606). This can result in a buffer over-read (CWE-125) by reading from
memory beyond the bounds of the buffer if the message length variable indicates a length that is
longer than the size of a message body (CWE-130).
Observed Examples
Reference Description
CVE-2014-0160 Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130)
enabling an out-of-bounds read (CWE-126), returning memory that could
include private cryptographic keys and other sensitive data.
https://www.cve.org/CVERecord?id=CVE-2014-0160
CVE-2009-2299 Web application firewall consumes excessive memory when an HTTP request
contains a large Content-Length value but no POST data.
https://www.cve.org/CVERecord?id=CVE-2009-2299
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 993 SFP Secondary Cluster: Incorrect Input Handling 888 2417
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Inconsistent Elements
CWE-241: Improper Handling of Unexpected Data Type
CWE Version 4.14
CWE-241: Improper Handling of Unexpected Data Type
CWE-241: Improper Handling of Unexpected Data Type