...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT C Secure Coding Standard | ARR01-C. Do not apply the sizeof operator to a pointer when taking the size of an array INT31-C. Ensure that integer conversions do not result in lost or misinterpreted data | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C Secure Coding Standard | INT32-C. Ensure that operations on signed integers do not result in overflow | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C Secure Coding Standard | INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT C Secure Coding Standard | MEM04-C. Beware of zero-length allocations | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TR 24772:2013 | Buffer Boundary Violation (Buffer Overflow) [HCB] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TS 17961:2013 | Taking the size of a pointer to determine the size of the pointed-to type [sizeofptr] |
| Prior to 2018-01-12: CERT: Unspecified Relationship | ||
| CWE 2.11 | CWE-131, Incorrect Calculation of Buffer Size | 2017-05-16: CERT: Rule subset of CWE |
| CWE 2.11 | CWE-680 | 2017-05-18: CERT: Rule subset of CWE |
| CWE |
sizeof() on a Pointer Type| 2.11 | CWE-789 | 2017-06-12: CERT: Partial overlap |
CERT-CWE Mapping Notes
Key here for mapping notes
CWE-680 and MEM35-C
Intersection( INT32-C, MEM35-C) = Ø
CWE-680 = Union( MEM35-C, list) where list =
- Overflowed buffers with inadequate sizes not produced by integer overflow
CWE-467 and MEM35-C
CWE-467 = Subset( MEM35-C)
CWE-789 and MEM35-C
Intersection( MEM35-C, CWE-789) =
- Insufficient memory allocation on the heap
MEM35-C – CWE-789 =
- Insufficient memory allocation with trusted value but incorrect calculation
CWE-789 - MEM35-C =
- Sufficient memory allocation (possibly over-allocation) with untrusted value
CWE-120 and MEM35-C
Intersection( MEM35-C, CWE-120) = Ø
CWE-120 specifically addresses buffer overflow operations, which occur in the context of string-copying. MEM35-C specifically addresses allocation of memory ranges (some of which may be for subsequent string copy operations).
Consequently, they address different sections of code, although one (or both) may be responsible for a single buffer overflow vulnerability.
CWE-131 and MEM35-C
- Intersection( INT30-C, MEM35-C) = Ø
- CWE-131 = Union( MEM35-C, list) where list =
- Miscalculating a buffer for a non-heap region (such as a variable-length array)
Bibliography
| [Coverity 2007] | |
| [Drepper 2006] | Section 2.1.1, "Respecting Memory Bounds" |
| [Seacord 2013] | Chapter 4, "Dynamic Memory Management" Chapter 5, "Integer Security" |
| [Viega 2005] | Section 5.6.8, "Use of sizeof() on a Pointer Type" |
| [xorl 2009] | CVE-2009-0587: Evolution Data Server Base64 Integer Overflows |
...