In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | P | 682 | Incorrect Calculation |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 465 | Pointer Issues |
| MemberOf | Prohibited | C | 737 | CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP) |
| MemberOf | Prohibited | V | 884 | CWE Cross-section |
| MemberOf | Prohibited | C | 998 | SFP Secondary Cluster: Glitch in Computation |
| MemberOf | Prohibited | C | 1160 | SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) |
| MemberOf | Prohibited | C | 1408 | Comprehensive Categorization: Incorrect Calculation |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-273 | Medium likelihood of exploit |
| MemberOf | Prohibited | BS | BOSS-323 | Read Memory (impact) |
| MemberOf | Prohibited | BS | BOSS-331 | Modify Memory (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 1160 | SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 465 | Pointer Issues |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 998 | SFP Secondary Cluster: Glitch in Computation |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrity | N/A | Read MemoryModify Memory | Incorrect pointer scaling will often result in buffer overflow conditions. Confidentiality can be compromised if the weakness is in the context of a buffer over-read or under-read. |
Incorrect pointer scaling will often result in buffer overflow conditions. Confidentiality can be compromised if the weakness is in the context of a buffer over-read or under-read.
Use a platform with high-level memory abstractions.
Always use array indexing instead of direct pointer manipulation.
Use technologies for preventing buffer overflows.
Programmers may try to index from a pointer by adding a number of bytes. This is incorrect because C and C++ implicitly scale the operand by the size of the data type.
This example attempts to calculate the position of the second byte of a pointer.
In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment.
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| CLASP | N/A | N/A | Unintentional pointer scaling |
| CERT C Secure Coding | ARR39-C | Exact | Do not add or subtract a scaled integer to a pointer |
| CERT C Secure Coding | EXP08-C | N/A | Ensure pointer arithmetic is used correctly |
| Software Fault Patterns | SFP1 | N/A | Glitch in computation |
| ID | Name |
|---|