489
Example Language: C (Good)
for(i=0; i<PATH_SIZE; i++) {
...
Example 4:
As another example the Off-by-one error can occur when using the sprintf library function to copy
a string variable to a formatted string variable and the original string variable comes from an
untrusted source. As in the following example where a local function, setFilename is used to store
the value of a filename to a database but first uses sprintf to format the filename. The setFilename
function includes an input parameter with the name of the file that is used as the copy source in the
sprintf function. The sprintf function will copy the file name to a char array of size 20 and specifies
the format of the new variable as 16 characters followed by the file extension .dat.
Example Language: C (Bad)
int setFilename(char *filename) {
char name[20];
sprintf(name, "%16s.dat", filename);
int success = saveFormattedFilenameToDB(name);
return success;
}
However this will cause an Off-by-one error if the original filename is exactly 16 characters or larger
because the format of 16 characters with the file extension is exactly 20 characters and does not
take into account the required null terminator that will be placed at the end of the string.
Observed Examples
Reference Description
CVE-2003-0252 Off-by-one error allows remote attackers to cause a denial of service and
possibly execute arbitrary code via requests that do not contain newlines.
https://www.cve.org/CVERecord?id=CVE-2003-0252
CVE-2001-1391 Off-by-one vulnerability in driver allows users to modify kernel memory.
https://www.cve.org/CVERecord?id=CVE-2001-1391
CVE-2002-0083 Off-by-one error allows local users or remote malicious servers to gain
privileges.
https://www.cve.org/CVERecord?id=CVE-2002-0083
CVE-2002-0653 Off-by-one buffer overflow in function usd by server allows local users to
execute arbitrary code as the server user via .htaccess files with long entries.
https://www.cve.org/CVERecord?id=CVE-2002-0653
CVE-2002-0844 Off-by-one buffer overflow in version control system allows local users to
execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2002-0844
CVE-1999-1568 Off-by-one error in FTP server allows a remote attacker to cause a denial of
service (crash) via a long PORT command.
https://www.cve.org/CVERecord?id=CVE-1999-1568
CVE-2004-0346 Off-by-one buffer overflow in FTP server allows local users to gain privileges
via a 1024 byte RETR command.
https://www.cve.org/CVERecord?id=CVE-2004-0346
CVE-2004-0005 Multiple buffer overflows in chat client allow remote attackers to cause a denial
of service and possibly execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2004-0005
CVE-2003-0356 Multiple off-by-one vulnerabilities in product allow remote attackers to cause a
denial of service and possibly execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2003-0356
CWE Version 4.14
CWE-193: Off-by-one Error
CWE-193: Off-by-one Error