1110
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Memory
Modify Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Maintenance
This entry should have a chaining relationship with CWE-119 instead of a parent / child
relationship, however the focus of this weakness does not map cleanly to any existing entries
in CWE. A new parent is being considered which covers the more generic problem of incorrect
return values. There is also an abstract relationship to weaknesses in which one component
sends incorrect messages to another component; in this case, one routine is sending an
incorrect value to another.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Illegal Pointer Value
Software Fault Patterns SFP1 Glitch in computation
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-467: Use of sizeof() on a Pointer Type
Weakness ID : 467
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-467: Use of sizeof() on a Pointer Type
CWE-467: Use of sizeof() on a Pointer Type