357
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the
tester to record and modify an active session. Specifically, manual static analysis is useful for
evaluating the correctness of allocation calculations. This can be useful for detecting overflow
conditions (CWE-190) or similar weaknesses that might have serious security impacts on the
program.
Effectiveness = High
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = High
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source
Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost
effective for partial coverage: Source Code Quality Analyzer
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input,
allocate enough memory to handle the largest possible encoding. For example, in a routine that
converts "&" characters to "&amp;" for HTML entity encoding, the output buffer needs to be at
least 5 times as large as the input buffer.
Phase: Implementation
Understand the programming language's underlying representation and how it interacts with
numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision,
signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number"
calculations, and how the language handles numbers that are too large or too small for its
CWE Version 4.14
CWE-131: Incorrect Calculation of Buffer Size
CWE-131: Incorrect Calculation of Buffer Size