372
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Always verify the length of the string unit character.
Phase: Implementation
Strategy = Libraries or Frameworks
Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type
(e.g.: byte, wchar_t, etc.)
Demonstrative Examples
Example 1:
The following example would be exploitable if any of the commented incorrect malloc calls were
used.
Example Language: C (Bad)
#include <stdio.h>
#include <strings.h>
#include <wchar.h>
int main() {
wchar_t wideString[] = L"The spazzy orange tiger jumped " \
"over the tawny jaguar.";
wchar_t *newString;
printf("Strlen() output: %d\nWcslen() output: %d\n",
strlen(wideString), wcslen(wideString));
/* Wrong because the number of chars in a string isn't related to its length in bytes //
newString = (wchar_t *) malloc(strlen(wideString));
*/
/* Wrong because wide characters aren't 1 byte long! //
newString = (wchar_t *) malloc(wcslen(wideString));
*/
/* Wrong because wcslen does not include the terminating null */
newString = (wchar_t *) malloc(wcslen(wideString) * sizeof(wchar_t));
/* correct! */
newString = (wchar_t *) malloc((wcslen(wideString) + 1) * sizeof(wchar_t));
/* ... */
}
The output from the printf() statement would be:
Example Language: (Result)
Strlen() output: 0
Wcslen() output: 53
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 741 CERT C Secure Coding Standard (2008) Chapter 8 -
Characters and Strings (STR)
734 2344
CWE Version 4.14
CWE-138: Improper Neutralization of Special Elements
CWE-138: Improper Neutralization of Special Elements