1726
There are close relationships between incorrect pointer dereferences and other weaknesses
related to buffer operations. There may not be sufficient community agreement regarding
these relationships. Further study is needed to determine when these relationships are chains,
composites, perspective/layering, or other types of relationships. As of September 2010, most of
the relationships are being captured as chains.
Terminology
Many weaknesses related to pointer dereferences fall under the general term of "memory
corruption" or "memory safety." As of September 2010, there is no commonly-used terminology
that covers the lower-level variants.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
129 Pointer Manipulation
CWE-823: Use of Out-of-range Pointer Offset
Weakness ID : 823
Structure : Simple
Abstraction : Base
Description
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point
outside of the intended range of valid memory locations for the resulting pointer.
Extended Description
While a pointer can contain a reference to any arbitrary memory location, a program typically only
intends to use the pointer to access limited portions of memory, such as contiguous memory used
to access an individual array.
Programs may use offsets in order to access fields or sub-elements stored within structured data.
The offset might be out-of-range if it comes from an untrusted source, is the result of an incorrect
calculation, or occurs because of another error.
If an attacker can control or influence the offset so that it points outside of the intended boundaries
of the structure, then the attacker may be able to read or write to memory locations that are
used elsewhere in the product. As a result, the attack might change the state of the product as
accessed through program variables, cause a crash or instable behavior, and possibly lead to code
execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer