317
Example 2:
This example takes an IP address from a user, verifies that it is well formed and then looks up the
hostname and copies it into a buffer.
Example Language: C (Bad)
void host_lookup(char *user_supplied_addr){
struct hostent *hp;
in_addr_t *addr;
char hostname[64];
in_addr_t inet_addr(const char *cp);
/*routine that ensures user_supplied_addr is in the right format for conversion */
validate_addr_form(user_supplied_addr);
addr = inet_addr(user_supplied_addr);
hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);
strcpy(hostname, hp->h_name);
}
This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee
that the hostname will not be larger than 64 bytes. If an attacker specifies an address which
resolves to a very large hostname, then the function may overwrite sensitive data or even
relinquish control flow to the attacker.
Note that this example also contains an unchecked return value (CWE-252) that can lead to a
NULL pointer dereference (CWE-476).
Observed Examples
Reference Description
CVE-2021-35395 Stack-based buffer overflows in SFK for wifi chipset used for IoT/embedded
devices, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-35395
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 970 SFP Secondary Cluster: Faulty Buffer Access 888 2405
MemberOf 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays
(ARR)
1154 2457
MemberOf 1161 SEI CERT C Coding Standard - Guidelines 07.
Characters and Strings (STR)
1154 2458
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Other
Stack-based buffer overflows can instantiate in return address overwrites, stack pointer
overwrites or frame pointer overwrites. They can also be considered function pointer overwrites,
array indexer overwrites or write-what-where condition, etc.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Stack overflow
Software Fault Patterns SFP8 Faulty Buffer Access
CWE Version 4.14
CWE-122: Heap-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow