1677
If $num is a large value such as 2147483648 (1<<31), then the assignment to $messages[$num]
would attempt to create a very large array, then eventually produce an error message such as:
Out of memory during array extend
This memory exhaustion will cause the Perl program to exit, possibly a denial of service. In
addition, the lack of memory could also prevent many other programs from successfully running on
the system.
Example 6:
This example shows a typical attempt to parse a string with an error resulting from a difference
in assumptions between the caller to a function and the function's action. The buffer length ends
up being -1 resulting in a blown out stack. The space character after the colon is included in the
function calculation, but not in the caller's calculation. This, unfortunately, is not usually so obvious
but exists in an obtuse series of calculations.
Example Language: C (Bad)
int proc_msg(char *s, int msg_len)
{
int pre_len = sizeof("preamble: "); // Note space at the end of the string - assume all strings have preamble with space
char buf[pre_len - msg_len];
... Do processing here and set status
return status;
}
char *s = "preamble: message\n";
char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space)
int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero length
int ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stack
Example Language: C (Good)
int proc_msg(char *s, int msg_len)
{
int pre_len = sizeof("preamble: "); // Note space at the end of the string - assume all strings have preamble with space
if (pre_len <= msg_len) { // Log error; return error_code; }
char buf[pre_len - msg_len];
... Do processing here and set status
return status;
}
char *s = "preamble: message\n";
char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space)
int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero length
int ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stack
Observed Examples
Reference Description
CVE-2022-21668 Chain: Python library does not limit the resources used to process images
that specify a very large number of bands (CWE-1284), leading to excessive
memory consumption (CWE-789) or an integer overflow (CWE-190).
https://www.cve.org/CVERecord?id=CVE-2022-21668
CVE-2010-3701 program uses ::alloca() for encoding messages, but large messages trigger
segfault
https://www.cve.org/CVERecord?id=CVE-2010-3701
CVE-2008-1708 memory consumption and daemon exit by specifying a large value in a length
field
https://www.cve.org/CVERecord?id=CVE-2008-1708
CVE-2008-0977 large value in a length field leads to memory consumption and crash when no
more memory is available
https://www.cve.org/CVERecord?id=CVE-2008-0977
CWE Version 4.14
CWE-790: Improper Filtering of Special Elements
CWE-790: Improper Filtering of Special Elements