1672
In the following example, it is possible to request that memcpy move a much larger segment of
memory than assumed:
Example Language: C (Bad)
int returnChunkSize(void *) {
/* if chunk info is valid, return the size of usable memory,
* else, return -1 to indicate an error
*/
...
}
int main() {
...
memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));
...
}
If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is
not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument
to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be
interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely
available to the destination buffer (CWE-787, CWE-788).
Example 3:
This example applies an encoding procedure to an input string and stores it into a buffer.
Example Language: C (Bad)
char * copy_input(char *user_supplied_string){
int i, dst_index;
char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);
if ( MAX_SIZE <= strlen(user_supplied_string) ){
die("user string too long, die evil hacker!");
}
dst_index = 0;
for ( i = 0; i < strlen(user_supplied_string); i++ ){
if( '&' == user_supplied_string[i] ){
dst_buf[dst_index++] = '&';
dst_buf[dst_index++] = 'a';
dst_buf[dst_index++] = 'm';
dst_buf[dst_index++] = 'p';
dst_buf[dst_index++] = ';';
}
else if ('<' == user_supplied_string[i] ){
/* encode to &lt; */
}
else dst_buf[dst_index++] = user_supplied_string[i];
}
return dst_buf;
}
The programmer attempts to encode the ampersand character in the user-controlled string,
however the length of the string is validated before the encoding procedure is applied. Furthermore,
the programmer assumes encoding expansion will only expand a given character by a factor of
4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure
expands the string it is possible to overflow the destination buffer if the attacker provides a string of
many ampersands.
Example 4:
In the following C/C++ example the method processMessageFromSocket() will get a message from
a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains
the message length and the message body. A for loop is used to copy the message body into a
local character string which will be passed to another method for processing.
CWE Version 4.14
CWE-788: Access of Memory Location After End of Buffer
CWE-788: Access of Memory Location After End of Buffer