Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-467:Use of sizeof() on a Pointer Type
Weakness ID:467
Version:v4.17
Weakness Name:Use of sizeof() on a Pointer Type
Vulnerability Mapping:Allowed
Abstraction:Variant
Structure:Simple
Status:Draft
Likelihood of Exploit:High
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.

▼Extended Description

The use of sizeof() on a pointer can sometimes generate useful information. An obvious case is to find out the wordsize on a platform. More often than not, the appearance of sizeof(pointer) indicates a bug.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowedB131Incorrect Calculation of Buffer Size
Nature: ChildOf
Mapping: Allowed
Type: Base
ID: 131
Name: Incorrect Calculation of Buffer Size
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC737CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)
MemberOfProhibitedC740CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)
MemberOfProhibitedC874CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
MemberOfProhibitedV884CWE Cross-section
MemberOfProhibitedC974SFP Secondary Cluster: Incorrect Buffer Length Computation
MemberOfProhibitedC1162SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
MemberOfProhibitedC1408Comprehensive Categorization: Incorrect Calculation
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 737
Name: CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 740
Name: CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 874
Name: CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
Nature: MemberOf
Mapping: Prohibited
Type:View
ID: 884
Name: CWE Cross-section
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 974
Name: SFP Secondary Cluster: Incorrect Buffer Length Computation
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1162
Name: SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1408
Name: Comprehensive Categorization: Incorrect Calculation
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-274High likelihood of exploit
MemberOfProhibitedBSBOSS-323Read Memory (impact)
MemberOfProhibitedBSBOSS-331Modify Memory (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-274
Name: High likelihood of exploit
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-323
Name: Read Memory (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-331
Name: Modify Memory (impact)
▼Relevant To View
Relevant to the view"Weaknesses Addressed by the SEI CERT C Coding Standard - (1154)"
NatureMappingTypeIDName
MemberOfProhibitedC1162SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1162
Name: SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC974SFP Secondary Cluster: Incorrect Buffer Length Computation
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 974
Name: SFP Secondary Cluster: Incorrect Buffer Length Computation
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
IntegrityConfidentialityN/AModify MemoryRead Memory

This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.

Scope: Integrity, Confidentiality
Likelihood: N/A
Impact: Modify Memory, Read Memory
Note:

This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.

▼Potential Mitigations
Phase:Implementation
Mitigation ID:
Strategy:
Effectiveness:
Description:

Use expressions such as "sizeof(*pointer)" instead of "sizeof(pointer)", unless you intend to run sizeof() on a pointer type to gain some platform independence or if you are allocating a variable on the stack.

Note:

▼Modes Of Introduction
Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: C(Undetermined Prevalence)
Class: C++(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

Care should be taken to ensure sizeof returns the size of the data structure itself, and not the size of the pointer to the data structure.

Language: ( code)
N/A

Language: ( code)
N/A

In this example, sizeof(foo) returns the size of the pointer.

Language: C(Bad code)
double *foo; ... foo = (double *)malloc(sizeof(foo));

Language: ( code)
N/A

In this example, sizeof(*foo) returns the size of the data structure and not the size of the pointer.

Language: C(Good code)
double *foo; ... foo = (double *)malloc(sizeof(*foo));

Example 2

This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.

Language: ( code)
N/A

Language: C(Bad code)
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */* char *username = "admin"; char *pass = "password"; int AuthenticateUser(char *inUser, char *inPass) { printf("Sizeof username = %d\n", sizeof(username)); printf("Sizeof pass = %d\n", sizeof(pass)); if (strncmp(username, inUser, sizeof(username))) { printf("Auth failure of username using sizeof\n"); return(AUTH_FAIL); } /* Because of CWE-467, the sizeof returns 4 on many platforms and architectures. */* if (! strncmp(pass, inPass, sizeof(pass))) { printf("Auth success of password using sizeof\n"); return(AUTH_SUCCESS); } else { printf("Auth fail of password using sizeof\n"); return(AUTH_FAIL); } } int main (int argc, char **argv) { int authResult; if (argc < 3) { ExitError("Usage: Provide a username and password"); } authResult = AuthenticateUser(argv[1], argv[2]); if (authResult != AUTH_SUCCESS) { ExitError("Authentication failed"); } else { DoAuthenticatedTask(argv[1]); } }

Language: ( code)
N/A

In AuthenticateUser(), because sizeof() is applied to a parameter with an array type, the sizeof() call might return 4 on many modern architectures. As a result, the strncmp() call only checks the first four characters of the input password, resulting in a partial comparison (CWE-187), leading to improper authentication (CWE-287).

Language: ( code)
N/A

Because of the partial comparison, any of these passwords would still cause authentication to succeed for the "admin" user:

Language: (Attack code)
pass5 passABCDEFGH passWORD

Language: ( code)
N/A

Because only 4 characters are checked, this significantly reduces the search space for an attacker, making brute force attacks more feasible.

Language: ( code)
N/A

The same problem also applies to the username, so values such as "adminXYZ" and "administrator" will succeed for the username.

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      Primary
      N/A
      Ordinality: Primary
      Description:
      N/A
      ▼Detection Methods
      Automated Static Analysis
      Detection Method ID:DM-14
      Description:

      Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

      Effectiveness:High
      Note:

      N/A

      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      CLASPN/AN/AUse of sizeof() on a pointer type
      CERT C Secure CodingARR01-CN/ADo not apply the sizeof operator to a pointer when taking the size of an array
      CERT C Secure CodingMEM35-CCWE More AbstractAllocate sufficient memory for an object
      Software Fault PatternsSFP10N/AIncorrect Buffer Length Computation
      Taxonomy Name: CLASP
      Entry ID: N/A
      Fit: N/A
      Entry Name: Use of sizeof() on a pointer type
      Taxonomy Name: CERT C Secure Coding
      Entry ID: ARR01-C
      Fit: N/A
      Entry Name: Do not apply the sizeof operator to a pointer when taking the size of an array
      Taxonomy Name: CERT C Secure Coding
      Entry ID: MEM35-C
      Fit: CWE More Abstract
      Entry Name: Allocate sufficient memory for an object
      Taxonomy Name: Software Fault Patterns
      Entry ID: SFP10
      Fit: N/A
      Entry Name: Incorrect Buffer Length Computation
      ▼Related Attack Patterns
      IDName
      ▼References
      Reference ID: REF-18
      Title: The CLASP Application Security Process
      Author: Secure Software, Inc.
      Section:
      Publication:
      Publisher:
      Edition:
      URL:https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
      URL Date:2024-11-17
      Day:N/A
      Month:N/A
      Year:2005
      Reference ID: REF-442
      Title: EXP01-A. Do not take the sizeof a pointer to determine the size of a type
      Author: Robert Seacord
      Section:
      Publication:
      Publisher:
      Edition:
      URL:https://www.securecoding.cert.org/confluence/display/seccode/EXP01-A.+Do+not+take+the+sizeof+a+pointer+to+determine+the+size+of+a+type
      URL Date:
      Day:N/A
      Month:N/A
      Year:N/A
      Details not found