361
Example Language: C (Bad)
img_t table_ptr; /*struct containing img data, 10kB each*/
int num_imgs;
...
num_imgs = get_num_imgs();
table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);
...
This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the
calculation determining the size of the list will eventually overflow (CWE-190). This will result in
a very small list to be allocated instead. If the subsequent code operates on the list as if it were
num_imgs long, it may result in many types of out-of-bounds problems (CWE-119).
Example 3:
This example applies an encoding procedure to an input string and stores it into a buffer.
Example Language: C (Bad)
char * copy_input(char *user_supplied_string){
int i, dst_index;
char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);
if ( MAX_SIZE <= strlen(user_supplied_string) ){
die("user string too long, die evil hacker!");
}
dst_index = 0;
for ( i = 0; i < strlen(user_supplied_string); i++ ){
if( '&' == user_supplied_string[i] ){
dst_buf[dst_index++] = '&';
dst_buf[dst_index++] = 'a';
dst_buf[dst_index++] = 'm';
dst_buf[dst_index++] = 'p';
dst_buf[dst_index++] = ';';
}
else if ('<' == user_supplied_string[i] ){
/* encode to &lt; */
}
else dst_buf[dst_index++] = user_supplied_string[i];
}
return dst_buf;
}
The programmer attempts to encode the ampersand character in the user-controlled string,
however the length of the string is validated before the encoding procedure is applied. Furthermore,
the programmer assumes encoding expansion will only expand a given character by a factor of
4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure
expands the string it is possible to overflow the destination buffer if the attacker provides a string of
many ampersands.
Example 4:
The following code is intended to read an incoming packet from a socket and extract one or more
headers.
Example Language: C (Bad)
DataPacket *packet;
int numHeaders;
PacketHeader *headers;
sock=AcceptSocketConnection();
ReadPacket(packet, sock);
numHeaders =packet->headers;
if (numHeaders > 100) {
ExitError("too many headers!");
}
CWE Version 4.14
CWE-131: Incorrect Calculation of Buffer Size
CWE-131: Incorrect Calculation of Buffer Size