Page History

...

wchar_t *f7() {


	const wchar_t *p = L"Hello, World!";
	const size_t n = sizeof(p) * (wcslen(p) + 1);


	wchar_t *q = (wchar_t *)malloc(n);
	return q;


}

Compliant Solution

This compliant solution makes sure that the of 'n' is not greater the the minimum of effective sizes of *p and *q.

wchar_t *f7() {

	const wchar_t *p = L"Hello, World!";
	const size_t n = sizeof(wchar_t);


	wchar_t *q = (wchar_t *)malloc(n);
	return q;


}

Risk Assessment

Depending on the library function called, the attacker may be able to use a heap overflow vulnerability to run arbitrary code. The detection of checks specified in description can be automated but the remediation has to be manual.

...