Description
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
Potential Impact
- Integrity: Modify Memory
- Integrity: Execute Unauthorized Code or Commands
- Access Control: Bypass Protection Mechanism
How to Fix
Requirements
Choose a language that is not susceptible to these issues.
Implementation
All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
- Automated Dynamic Analysis: Use tools that are integrated during
compilation to insert runtime error-checking mechanisms
related to memory safety errors, such as AddressSanitizer
(ASan) for C/C++ [REF-1518]....
Related Weaknesses
References
View on MITRE CWE Database →
