1659
Scope Impact Likelihood
Integrity
Availability
Modify Memory
DoS: Crash, Exit, or Restart
Out of bounds memory access will very likely result in the
corruption of relevant memory, and perhaps instructions,
possibly leading to a crash.
Integrity Modify Memory
Execute Unauthorized Code or Commands
If the corrupted memory can be effectively controlled, it
may be possible to execute arbitrary code. If the corrupted
memory is data rather than instructions, the system will
continue to function with improper changes, possibly in
violation of an implicit or explicit policy.
Detection Methods
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs
- either randomly or algorithmically - and dynamically invoking the code with those inputs.
Even with random inputs, it is often capable of generating unexpected results such as crashes,
memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases
that clearly indicate bugs, which helps developers to diagnose the issues.
Effectiveness = High
Demonstrative Examples
Example 1:
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character
string. The function copies the input string to a local character string and uses a while statement to
remove the trailing whitespace by moving backward through the string and overwriting whitespace
with a NUL character.
Example Language: C (Bad)
char* trimTrailingWhitespace(char *strMessage, int length) {
char *retMessage;
char *message = malloc(sizeof(char)*(length+1));
// copy input string to a temporary string
char message[length+1];
int index;
for (index = 0; index < length; index++) {
message[index] = strMessage[index];
}
message[index] = '\0';
// trim trailing whitespace
int len = index-1;
while (isspace(message[len])) {
message[len] = '\0';
len--;
}
// return string without trailing whitespace
retMessage = message;
return retMessage;
}
However, this function can cause a buffer underwrite if the input character string contains all
whitespace. On some systems the while statement will move backwards past the beginning of a
character string and will call the isspace() function on an address outside of the bounds of the local
buffer.
CWE Version 4.14
CWE-786: Access of Memory Location Before Start of Buffer
CWE-786: Access of Memory Location Before Start of Buffer