492
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Other
Read Memory
Modify Memory
Other
When an unexpected sign extension occurs in code that
operates directly on memory buffers, such as a size value
or a memory index, then it could cause the program to
write or read outside the boundaries of the intended buffer.
If the numeric value is associated with an application-level
resource, such as a quantity or price for a product in an ecommerce
site, then the sign extension could produce a
value that is much higher (or lower) than the application's
allowable range.
Potential Mitigations
Phase: Implementation
Avoid using signed variables if you don't need to represent negative values. When negative
values are needed, perform validation after you save those values to larger data types, or before
passing them to functions that are expecting unsigned values.
Demonstrative Examples
Example 1:
The following code reads a maximum size and performs a sanity check on that size. It then
performs a strncpy, assuming it will not exceed the boundaries of the array. While the use of "short
s" is forced in this particular example, short int's are frequently used within real-world code, such as
code that processes structured data.
Example Language: C (Bad)
int GetUntrustedInt () {
return(0x0000FFFF);
}
void main (int argc, char **argv) {
char path[256];
char *input;
int i;
short s;
unsigned int sz;
i = GetUntrustedInt();
s = i;
/* s is -1 so it passes the safety check - CWE-697 */
if (s > 256) {
DiePainfully("go away!\n");
}
/* s is sign-extended and saved in sz */
sz = s;
/* output: i=65535, s=-1, sz=4294967295 - your mileage may vary */
printf("i=%d, s=%d, sz=%u\n", i, s, sz);
input = GetUserInput("Enter pathname:");
/* strncpy interprets s as unsigned int, so it's treated as MAX_INT
(CWE-195), enabling buffer overflow (CWE-119) */
strncpy(path, input, s);
path[255] = '\0'; /* don't want CWE-170 */
printf("Path is: %s\n", path);
}
This code first exhibits an example of CWE-839, allowing "s" to be a negative number. When the
negative short "s" is converted to an unsigned integer, it becomes an extremely large positive
integer. When this converted integer is used by strncpy() it will lead to a buffer overflow (CWE-119).
CWE Version 4.14
CWE-194: Unexpected Sign Extension
CWE-194: Unexpected Sign Extension