475
Phase: Implementation
Strategy = Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range.
Enforce that the input meets both the minimum and maximum requirements for the expected
range. Use unsigned integers where possible. This makes it easier to perform validation for
integer overflows. When signed integers are required, ensure that the range check includes
minimum values as well as maximum values.
Phase: Implementation
Understand the programming language's underlying representation and how it interacts with
numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision,
signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number"
calculations, and how the language handles numbers that are too large or too small for its
underlying representation. [REF-7] Also be careful to account for 32-bit, 64-bit, and other
potential differences that may affect the numeric representation.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Implementation
Strategy = Compilation or Build Hardening
Examine compiler warnings closely and eliminate problems with potential security implications,
such as signed / unsigned mismatch in memory operations, or use of uninitialized variables.
Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the
entire system.
Demonstrative Examples
Example 1:
The following image processing code allocates a table for images.
Example Language: C (Bad)
img_t table_ptr; /*struct containing img data, 10kB each*/
int num_imgs;
...
num_imgs = get_num_imgs();
table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);
...
This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the
calculation determining the size of the list will eventually overflow (CWE-190). This will result in
a very small list to be allocated instead. If the subsequent code operates on the list as if it were
num_imgs long, it may result in many types of out-of-bounds problems (CWE-119).
Example 2:
The following code excerpt from OpenSSH 3.3 demonstrates a classic case of integer overflow:
Example Language: C (Bad)
nresp = packet_get_int();
if (nresp > 0) {
response = xmalloc(nresp*sizeof(char*));
for (i = 0; i < nresp; i++) response[i] = packet_get_string(NULL);
CWE Version 4.14
CWE-190: Integer Overflow or Wraparound
CWE-190: Integer Overflow or Wraparound