362
headers = malloc(numHeaders * sizeof(PacketHeader);
ParsePacketHeaders(packet, headers);
The code performs a check to make sure that the packet does not contain too many headers.
However, numHeaders is defined as a signed int, so it could be negative. If the incoming packet
specifies a value such as -3, then the malloc calculation will generate a negative number (say,
-300 if each header can be a maximum of 100 bytes). When this result is provided to malloc(), it is
first converted to a size_t type. This conversion then produces a large value such as 4294966996,
which may cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195).
With the appropriate negative numbers, an attacker could trick malloc() into using a very small
positive number, which then allocates a buffer that is much smaller than expected, potentially
leading to a buffer overflow.
Example 5:
The following code attempts to save three different identification numbers into an array. The array
is allocated from memory using a call to malloc().
Example Language: C (Bad)
int *id_sequence;
/* Allocate space for an array of three ids. */
id_sequence = (int*) malloc(3);
if (id_sequence == NULL) exit(1);
/* Populate the id array. */
id_sequence[0] = 13579;
id_sequence[1] = 24680;
id_sequence[2] = 97531;
The problem with the code above is the value of the size parameter used during the malloc() call. It
uses a value of '3' which by definition results in a buffer of three bytes to be created. However the
intention was to create a buffer that holds three ints, and in C, each int requires 4 bytes worth of
memory, so an array of 12 bytes is needed, 4 bytes for each int. Executing the above code could
result in a buffer overflow as 12 bytes of data is being saved into 3 bytes worth of allocated space.
The overflow would occur during the assignment of id_sequence[0] and would continue with the
assignment of id_sequence[1] and id_sequence[2].
The malloc() call could have used '3*sizeof(int)' as the value for the size parameter in order to
allocate the correct amount of space required to store the three ints.
Observed Examples
Reference Description
CVE-2020-17087 Chain: integer truncation (CWE-197) causes small buffer allocation (CWE-131)
leading to out-of-bounds write (CWE-787) in kernel pool, as exploited in the
wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-17087
CVE-2004-1363 substitution overflow: buffer overflow using environment variables that are
expanded after the length check is performed
https://www.cve.org/CVERecord?id=CVE-2004-1363
CVE-2004-0747 substitution overflow: buffer overflow using expansion of environment variables
https://www.cve.org/CVERecord?id=CVE-2004-0747
CVE-2005-2103 substitution overflow: buffer overflow using a large number of substitution
strings
https://www.cve.org/CVERecord?id=CVE-2005-2103
CVE-2005-3120 transformation overflow: product adds extra escape characters to incoming
data, but does not account for them in the buffer length
https://www.cve.org/CVERecord?id=CVE-2005-3120
CVE-2003-0899 transformation overflow: buffer overflow when expanding ">" to "&gt;", etc.
https://www.cve.org/CVERecord?id=CVE-2003-0899
CWE Version 4.14
CWE-131: Incorrect Calculation of Buffer Size
CWE-131: Incorrect Calculation of Buffer Size