1493
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding ERR34-
C
CWE More
Abstract
Detect errors when converting a string
to a number
CERT C Secure Coding FIO01-C Be careful using functions that use file
names for identification
CERT C Secure Coding MSC30-
C
CWE More
Abstract
Do not use the rand() function for
generating pseudorandom numbers
CERT C Secure Coding STR31-C Imprecise Guarantee that storage for strings has
sufficient space for character data and
the null terminator
Software Fault Patterns SFP3 Use of an improper API
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-554]Michael Howard. "Security Development Lifecycle (SDL) Banned Function Calls". <
https://learn.microsoft.com/en-us/previous-versions/bb288454(v=msdn.10)?redirectedfrom=MSDN
>.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-680: Integer Overflow to Buffer Overflow
Weakness ID : 680
Structure : Chain
Abstraction : Compound
Description
The product performs a calculation to determine how much memory to allocate, but an integer
overflow can occur that causes less memory to be allocated than expected, leading to a buffer
overflow.
Chain Components
Nature Type ID Name Page
StartsWith 190 Integer Overflow or Wraparound 472
FollowedBy 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer