353
}
However, the message length variable from the structure is used as the condition for ending the
for loop without validating that the message length variable accurately reflects the length of the
message body (CWE-606). This can result in a buffer over-read (CWE-125) by reading from
memory beyond the bounds of the buffer if the message length variable indicates a length that is
longer than the size of a message body (CWE-130).
Observed Examples
Reference Description
CVE-2014-0160 Chain: "Heartbleed" bug receives an inconsistent length parameter (CWE-130)
enabling an out-of-bounds read (CWE-126), returning memory that could
include private cryptographic keys and other sensitive data.
https://www.cve.org/CVERecord?id=CVE-2014-0160
CVE-2009-2299 Web application firewall consumes excessive memory when an HTTP request
contains a large Content-Length value but no POST data.
https://www.cve.org/CVERecord?id=CVE-2009-2299
CVE-2001-0825 Buffer overflow in internal string handling routine allows remote attackers
to execute arbitrary commands via a length argument of zero or less, which
disables the length check.
https://www.cve.org/CVERecord?id=CVE-2001-0825
CVE-2001-1186 Web server allows remote attackers to cause a denial of service via an HTTP
request with a content-length value that is larger than the size of the request,
which prevents server from timing out the connection.
https://www.cve.org/CVERecord?id=CVE-2001-1186
CVE-2001-0191 Service does not properly check the specified length of a cookie, which allows
remote attackers to execute arbitrary commands via a buffer overflow, or brute
force authentication by using a short cookie length.
https://www.cve.org/CVERecord?id=CVE-2001-0191
CVE-2003-0429 Traffic analyzer allows remote attackers to cause a denial of service and
possibly execute arbitrary code via invalid IPv4 or IPv6 prefix lengths, possibly
triggering a buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2003-0429
CVE-2000-0655 Chat client allows remote attackers to cause a denial of service or execute
arbitrary commands via a JPEG image containing a comment with an illegal
field length of 1.
https://www.cve.org/CVERecord?id=CVE-2000-0655
CVE-2004-0492 Server allows remote attackers to cause a denial of service and possibly
execute arbitrary code via a negative Content-Length HTTP header field
causing a heap-based buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2004-0492
CVE-2004-0201 Help program allows remote attackers to execute arbitrary commands via a
heap-based buffer overflow caused by a .CHM file with a large length field
https://www.cve.org/CVERecord?id=CVE-2004-0201
CVE-2003-0825 Name services does not properly validate the length of certain packets, which
allows attackers to cause a denial of service and possibly execute arbitrary
code. Can overlap zero-length issues
https://www.cve.org/CVERecord?id=CVE-2003-0825
CVE-2004-0095 Policy manager allows remote attackers to cause a denial of service (memory
consumption and crash) and possibly execute arbitrary code via an HTTP
POST request with an invalid Content-Length value.
https://www.cve.org/CVERecord?id=CVE-2004-0095
CVE-2004-0826 Heap-based buffer overflow in library allows remote attackers to execute
arbitrary code via a modified record length field in an SSLv2 client hello
message.
CWE Version 4.14
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-130: Improper Handling of Length Parameter Inconsistency