1359
In the following C/C++ example the method processMessageFromSocket() will get a message from
a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains
the message length and the message body. A for loop is used to copy the message body into a
local character string which will be passed to another method for processing.
Example Language: C (Bad)
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];
char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;
for (index = 0; index < msg->msgLength; index++) {
message[index] = msg->msgBody[index];
}
message[index] = '\0';
// process message
success = processMessage(message);
}
return success;
}
However, the message length variable from the structure is used as the condition for ending the
for loop without validating that the message length variable accurately reflects the length of the
message body (CWE-606). This can result in a buffer over-read (CWE-125) by reading from
memory beyond the bounds of the buffer if the message length variable indicates a length that is
longer than the size of a message body (CWE-130).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 994 SFP Secondary Cluster: Tainted Input to Variable 888 2417
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1406 Comprehensive Categorization: Improper Input
Validation
1400 2531
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP25 Tainted input to variable
OMG ASCSM ASCSMCWE-