Weakness (CWE)
CWE-131: Incorrect Calculation of Buffer Size
The product does not correctly calculate the size to be used when allocating a buffer.
How to prevent it (8 mitigations)
-
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input buffer.
-
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
-
Implementation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Implementation
When processing structured incoming data containing a size field followed by raw data, identify and resolve any inconsistencies between the size field and the actual size of the data (CWE-130).
-
Implementation
When allocating memory that uses sentinels to mark the end of a data structure - such as NUL bytes in strings - make sure you also include the sentinel in your calculation of the total amount of memory that must be allocated.
-
Implementation
Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
-
Implementation
Use sizeof() on the appropriate data type to avoid CWE-467.
Source: MITRE CWE-131
68 results · Clear filters · Feed
-
Medium 6.5
OpenBSD wg(4) kernel crash
In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.
-
Medium 6.2
When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the …
-
Medium 6.5
A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) …
-
Medium 5.3
The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and sm…
-
Medium 4.6
Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows…
-
Medium 5.5
In wipe_ns_memory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This…
-
Medium 5.3
Glibc: integer overflow in __vsyslog_internal()
An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation…
-
Medium 6.5
Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths
Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.
-
Medium 6.7
In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalat…
-
Medium 6.7
In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
Medium 6.7
In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege w…
-
Medium 6.7
In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with…
-
Medium 6.7
In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead …
-
Medium 6.7
In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead …
-
Medium 4.8
Overflow in `tf.keras.losses.poisson` in Tensorflow
TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size m…
-
Medium 4.8
Overflow in `FusedResizeAndPadConv2D` in Tensorflow
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in…
-
Medium 4.8
Overflow in `ImageProjectiveTransformV2` in Tensorflow
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included…
-
Medium 4.8
Overflow in `ResizeNearestNeighborGrad` in Tensorflow
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have patched the issue in GitHub commit 00c821af032ba9e5f5fa3fe14690c8d28a657624. The fix will be included …
-
Medium 6.5CVE-2022-31630 Public exploit
OOB read due to insufficient input validation in imageloadfont()
In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer wi…
-
Medium 6.8
In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to lo…
-
Medium 6.8
In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to lo…
-
Medium 6.6
RTI Connext DDS Professional and Connext DDS Secure Incorrect Calculation of Buffer Size
RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow.
-
Medium 6.6
GurumDDS Heap-based Incorrect Calculation of Buffer Size
All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.
-
Medium —
Unexpected panics in num-bigint
### Impact Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic. - The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic. - A buffer was allocated wit…
-
Medium 5.3
Heap OOB and null pointer dereference in `RaggedTensorToTensor`
TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit an undefined behavior if input arguments are empty. The implementation(https://github.com/tensorflow…
-
Medium 5.3
Junos OS: MX Series: MS-MPC/MIC might crash when processing malformed IPv6 packet in NAT64 configuration.
On Juniper Networks MX Series with MS-MIC or MS-MPC card configured with NAT64 configuration, receipt of a malformed IPv6 packet may crash the MS-PIC component on MS-MIC or MS-MPC. This issue occurs when a multiservice card is translating the malformed IPv6 p…
-
Medium 4.4
An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fs…
-
Medium 5.5
A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause a…