CWE-839

Numeric Range Comparison Without Minimum Check

Medium

Description

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

Potential Impact

How to Fix

Implementation

If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.

Implementation

If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-839 vulnerabilities in your codebase.

Get Security Assessment