Weakness (CWE)
CWE-135: Incorrect Calculation of Multi-Byte String Length
Base Draft
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
How to prevent it (2 mitigations)
-
Implementation
Always verify the length of the string unit character.
-
Implementation
Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)
Source: MITRE CWE-135
1 result · Clear filters · Feed
-
High 7.1
Gix-date: gix-date: undefined behavior due to invalid string generation
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these …