CWE-193 Off-by-one错误
Off-by-one Error
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 682 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 682 cwe_View_ID: 1003 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 682 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: CanPrecede cwe_CWE_ID: 617 cwe_View_ID: 1000
-
cwe_Nature: CanPrecede cwe_CWE_ID: 170 cwe_View_ID: 1000
-
cwe_Nature: CanPrecede cwe_CWE_ID: 119 cwe_View_ID: 1000
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Availability | ['DoS: Crash, Exit, or Restart', 'DoS: Resource Consumption (CPU)', 'DoS: Resource Consumption (Memory)', 'DoS: Instability'] | This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high. |
| Integrity | Modify Memory | If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur. |
| ['Confidentiality', 'Availability', 'Access Control'] | ['Execute Unauthorized Code or Commands', 'Bypass Protection Mechanism'] | This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy. |
可能的缓解方案
Implementation
策略:
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
示例代码
例
The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.
bad C
unsigned int numWidgets;
Widget WidgetList;
numWidgets = GetUntrustedSizeValue();
if ((numWidgets == 0) || (numWidgets > MAX_NUM_WIDGETS)) {
}
WidgetList = (Widget
printf("WidgetList ptr=%pn", WidgetList);
for(i=0; i
}
WidgetList[numWidgets] = NULL;
showWidgets(WidgetList);文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论