Page History

...

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
MEM35-C	high	probable	high	P6	L2

Automated Detection

Tool

Version

Checker

Description

Section
LDRA tool suite

Include Page

	c:LDRA_Vc:
	LDRA_V

Section
487 S

Section
Fully Implemented

Section
Fortify SCA

Section
V. 5.0

Section
can detect violations of this rule with CERT C Rule Pack, except those involving the `sizeof` operator

Section
Coverity Prevent

Include Page

	c:Coverity_Vc:
	Coverity_V

Section
SIZECHECK

Section
finds memory allocations that are assigned to a pointer that reference objects larger than the allocated block

Section
Coverity Prevent

Include Page

	c:Coverity_Vc:
	Coverity_V

Section
BAD_ALLOC_STRLEN

Section
can find the instances where string length is miscalculated (length calculated may be one less than intended) for memory allocation purposes. Coverity Prevent cannot discover all violations of this rule so further verification is necessary

Section
Compass/ROSE

Section

could check violations of this rule by examining the size expression to malloc() or memcpy() functions. Specifically, the size argument should be bounded by 0, SIZE_MAX, and, unless it is a variable of type size_t or rsize_t, it should be bounds-checked before the malloc() call. If the argument is of the expression a*b, then an appropriate check is:

Code Block
if (a < SIZE_MAX / b && a > 0) ...

Related Vulnerabilities

Wiki Markup[CVE-2009-0587|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0587] results from a violation of this rule. Before version 2.24.5, Evolution Data Server performed unchecked arithmetic operations on the length of a user-input string and used the value to allocate space for a new buffer. Thus, an attacker could execute arbitrary code by inputting a long string, resulting in incorrect allocation and buffer overflow \ [[xorl 2009|http://xorl .wordpress.com/ 2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/]\].

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

MITRE CWE: CWE-131, "Incorrect Calculation of Buffer Size"

Bibliography

Wiki Markup\[[Coverity 2007|AA. Bibliography#Coverity 07]\] \[[Seacord 2005|AA. Bibliography#Seacord 05]\] Chapter 4, "Dynamic Memory Management," and Chapter 5, "Integer Security" \[[xorl 2009|AA. Bibliography#xorl 2009]\] []
[Seacord 2005] Chapter 4, "Dynamic Memory Management," and Chapter 5, "Integer Security"
[xorl 2009] "CVE-2009-0587: Evolution Data Server Base64 Integer Overflows"|http://xorl.wordpress.com/2009/06/10/cve-2009-0587-evolution-data-server-base64-integer-overflows/]

...

08. Memory Management (MEM) 09. Input Output (FIO)

Space shortcuts

Page tree

Versions Compared

Old Version 108

New Version 109

Key

Automated Detection

Related Vulnerabilities

Bibliography