Skip to content
OpenAdvisories

Weakness (CWE)

CWE-839: Numeric Range Comparison Without Minimum Check

Base Incomplete

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

How to prevent it (2 mitigations)

  1. Implementation

    If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.

  2. Implementation

    If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.

Source: MITRE CWE-839

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed