Weakness (CWE)
CWE-135: Incorrect Calculation of Multi-Byte String Length
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
How to prevent it (2 mitigations)
-
Implementation
Always verify the length of the string unit character.
-
Implementation
Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)
Source: MITRE CWE-135
2 results · Feed
-
Medium 4.8
Rack: Content-Length mismatch in Rack::Files error responses
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the de…
-
High 7.1
Gix-date: gix-date: undefined behavior due to invalid string generation
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these …