1656
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
Weakness ID : 785
Structure : Simple
Abstraction : Variant
Description
The product invokes a function for normalizing paths or file names, but it provides an output buffer
that is smaller than the maximum possible size, such as PATH_MAX.
Extended Description
Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer
overflow. Such functions include realpath(), readlink(), PathAppend(), and others.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 120 Buffer Copy without Checking Size of Input ('Classic Buffer
Overflow')