Page History

...

#include <stdint.h>
#include <stdlib.h>
 
void function(size_t len) {
  long *p;
  if (len == 0 || len > SIZE_MAX / sizeof(long)) {
    /* Handle overflow */
  }
  p = (long *)malloc(len * sizeof(int));
  if (p == NULL) {
    /* Handle error */
  }
  free(p);
}

Compliant Solution (Integer)

This compliant solution uses sizeof(long) to correctly size the memory allocation:

#include <stdint.h>
#include <stdlib.h>

void function(size_t len) {
  long *p;
  if (len == 0 || len > SIZE_MAX / sizeof(long)) {
    /* Handle overflow */
  }
  p = (long *)malloc(len * sizeof(long));
  if (p == NULL) {
    /* Handle error */
  }
  free(p);
}

Compliant Solution (Integer)

Alternatively, sizeof(*p) can be used to properly size the allocation:

...

Providing invalid size arguments to memory allocation functions can lead to buffer overflows and the execution of arbitrary code with the permissions of the vulnerable process.

Automated Detection

if (a < SIZE_MAX / b && a > 0) ...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-680 and MEM35-C

Intersection( INT32-C, MEM35-C) = Ø

CWE-680 = Union( MEM35-C, list) where list =

• Overflowed buffers with inadequate sizes not produced by integer overflow

CWE-467 and MEM35-C

CWE-467 = Subset( MEM35-C)

CWE-789 and MEM35-C

Intersection( MEM35-C, CWE-789) =

• Insufficient memory allocation on the heap

MEM35-C – CWE-789 =

• Insufficient memory allocation with trusted value but incorrect calculation

CWE-789 - MEM35-C =

• Sufficient memory allocation (possibly over-allocation) with untrusted value

CWE-120 and MEM35-C

Intersection( MEM35-C, CWE-120) = Ø

CWE-120 specifically addresses buffer overflow operations, which occur in the context of string-copying. MEM35-C specifically addresses allocation of memory ranges (some of which may be for subsequent string copy operations).

Consequently, they address different sections of code, although one (or both) may be responsible for a single buffer overflow vulnerability.

CWE-131 and MEM35-C

• Intersection( INT30-C, MEM35-C) = Ø

• CWE-131 = Union( MEM35-C, list) where list =

• Miscalculating a buffer for a non-heap region (such as a variable-length array)

Bibliography

...

...

Image Modified Image Modified Image Modified