CWE-785 路径操作函数中使用未进行大小限定的缓冲区
Use of Path Manipulation Function without Maximum-sized Buffer
结构: Simple
Abstraction: Variant
状态: Incomplete
被利用可能性: unkown
基本描述
The software invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
扩展描述
Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath(), readlink(), PathAppend(), and others.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 676 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 120 cwe_View_ID: 1000
-
cwe_Nature: ChildOf cwe_CWE_ID: 120 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 20 cwe_View_ID: 700 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 20 cwe_View_ID: 699
适用平台
Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}]
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Integrity', 'Confidentiality', 'Availability'] | ['Modify Memory', 'Execute Unauthorized Code or Commands', 'DoS: Crash, Exit, or Restart'] |
可能的缓解方案
Implementation
策略:
Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.
示例代码
例
In this example the function creates a directory named "output
bad C
if (getCurrentDirectory(128, outputDirectoryName) == 0) {
}
if (!PathAppend(outputDirectoryName, "output")) {
}
if (!PathAppend(outputDirectoryName, name)) {
return null;
}
if (SHCreateDirectoryEx(NULL, outputDirectoryName, NULL) != ERROR_SUCCESS) {
return null;
}
return StrDup(outputDirectoryName);
}
For most values of the current directory and the name parameter, this function will work properly. However, if the name parameter is particularly long, then the second call to PathAppend() could overflow the outputDirectoryName buffer, which is smaller than MAX_PATH bytes.
Notes
Maintenance
Much of this entry was originally part of CWE-249, which was deprecated for several reasons.
Maintenance
This entry is at a much lower level of abstraction than most entries because it is function-specific. It also has significant overlap with other entries that can vary depending on the perspective. For example, incorrect usage could trigger either a stack-based overflow (CWE-121) or a heap-based overflow (CWE-122). The CWE team has not decided how to handle such entries.
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| 7 Pernicious Kingdoms | Often Misused: File System | ||
| Software Fault Patterns | SFP9 | Faulty String Expansion |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论