CWE-788: Access of Memory Location After End of Buffer

Confidentiality: Read Memory
Integrity: Modify Memory
Integrity: Modify Memory

Description

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand...
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518]....