Using pointer arithmetic such so that the result does not point into or just past the end of the same object, using such pointers in arithmetic expressions, or dereferencing pointers that do not point to a valid object in memory results in potentially exploitable undefined behavior and must be avoided.
Likewise, using an array subscript such so that the resulting reference does not refer to an element in the array also results in potentially exploitable, undefined behavior and must be avoided.
...
UB | Description | Example Code | |||
|---|---|---|---|---|---|
Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object. | |||||
Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that points just beyond the array object and is used as the operand of a unary | #Dereferencing Past The End Pointer, #Using Past The End Index | ||||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f6f89ca2d84f0ba3-15749d5a-49a74dbe-804dbbc2-19e49f49338e77cf96e7afe1"><ac:plain-text-body><![CDATA[ | [46 | CC. Undefined Behavior#ub_46] | An array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression | [#Apparently Accessible Out Of Range Index] | ]]></ac:plain-text-body></ac:structured-macro> |
An attempt is made to access, or generate a pointer to just past, a flexible array member of a structure when the referenced object provides no elements for that array. | |||||
The pointer passed to a library function array parameter does not have a value such that all address computations and object accesses are valid. |
...
In the following noncompliant code example the function f() attempts to validate the index before using it as an offset to the statically allocated table of integers. However, the function fails to reject negative index values. When index is less than zero, the behavior of the addition expression in the return statement of the function is undefined 43. On some implementations, the addition alone may trigger a hardware trap. On other implementations, using the result of the addition or dereferencing it may also trigger a hardware trap.
...
| Wiki Markup |
|---|
The following noncompliant code example shows the flawed logic in the Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface that was exploited by the W32.Blaster.Worm. The error is that the while loop in the {{GetMachineName()}} function (used to extract the host name from a longer string) is not sufficiently bounded. When the character array pointed to by {{pwszTemp}} does not contain the backslash character among the first {{MAX_COMPUTERNAME_LENGTH_FQDN + 1}} elements, the final valid iteration of the loop will dereference the past the end pointer resulting in exploitable undefined behavior [44|CC. Undefined Behavior#ub_44]. In this case, the actual exploit allowed the attacker to inject executable code into a running program. Economic damage from the Blaster worm has been estimated to be at least $525 million \[[Pethia 032003|AA. Bibliography#Pethia 03]\]. |
For a discussion of this programming error in the Common Weakness Enumeration database, see CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer and CWE-121: Stack-based Buffer Overflow].
...
In the following compliant solution, the while loop in the GetMachineName() function is bounded so that the loop terminates when a backslash character is found, the null termination character (L'\0' is discovered , or when the end of the buffer is reached. This code does not result in a buffer overflow, even if no backslash character is found in wszMachineName.
...
This compliant solution is for illustrative purposes and is not necessarily the solution implemented by Microsoft. This particular "solution" may not be correct , because there is no guarantee that a backslash is found.
...
In the following noncompliant code example the function f() calls fread() to read nitems of type wchar_t, each size bytes in size, into an array of BUFSIZ elements, wbuf. However, the expression used to compute the value of nitems fails to account for the fact that unlike the size of char, the size of wchar_t may be greater than 1. Thus, fread() may attempt to form pointers past the end of wbuf and use them to assign values to non-existing elements of the array. Such an attempt results in undefined behavior 103. A likely manifestation of this undefined behavior is a classic buffer overflow, which is often exploitable by code injection attacks.
For a discussion of this programming error in the Common Weakness Enumeration database, see CWE-121: Access of Memory Location After End of Buffer, and CWE-805: Buffer Access with Incorrect Length Value.
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ARR30-C | 3 (high) | 3 (likely) | 1 (high) | P9 | L2 |
Automated Detection
...
Tool | Version | Checker | Description | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
...
|
...
|
|
|
|
...
|
|
|
...
|
...
| |||||||||||||
|
|
|
| ||||||||||
|
|
|
|
...
|
...
Related Vulnerabilities
| Wiki Markup |
|---|
[CVE-2008-1517|http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-1517] results from a violation of this rule. Before Mac OSX version 10.5.7, the xnu kernel accessed an array at an unverified, user-input index, allowing an attacker to execute arbitrary code by passing an index greater than the length of the array and therefore accessing outside memory \[[xorl 2009|http://xorl.wordpress.com/2009/06/09/cve-2008-1517-apple-mac-os-x-xnu-missing-array-index-validation/]\]. |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
Related Guidelines
TO DO.
Bibliography
| Wiki Markup |
|---|
\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 6.7.5.2, "Array declarators" \[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "XYX Boundary Beginning Violation," "XYY Wrap-around Error," and "XYZ Unchecked Array Indexing" \[[CWE|AA. Bibliography#CWE]\] [CWE-119|http://cwe.mitre.org/data/definitions/119.html]: Failure to Constrain Operations within the Bounds of a Memory Buffer \[[CWE|AA. Bibliography#CWE]\] [CWE-121|http://cwe.mitre.org/data/definitions/121.html]: Stack-based Buffer Overflow \[[CWE|AA. Bibliography#CWE]\] [CWE-122|http://cwe.mitre.org/data/definitions/122.html]: Heap-based Buffer Overflow \[[CWE|AA. Bibliography#CWE]\] [CWE-129|http://cwe.mitre.org/data/definitions/129.html]: Unchecked Array Indexing \[[CWE|AA. Bibliography#CWE]\] [CWE-788|http://cwe.mitre.org/data/definitions/788.html]: Access of Memory Location After End of Buffer \[[CWE|AA. Bibliography#CWE]\] [CWE-805|http://cwe.mitre.org/data/definitions/805.html]: Buffer Access with Incorrect Length Value \[[Finlay 032003|AA. Bibliography#Finlay 03]\] \[[Microsoft 032003|AA. Bibliography#Microsoft 03]\] \[[Pethia 032003|AA. Bibliography#Pethia 03]\] \[[Seacord 05a2005a|AA. Bibliography#Seacord 05]\] Chapter 1, "Running with Scissors" \[[Viega 052005|AA. Bibliography#Viega 05]\] Section 5.2.13, "Unchecked array indexing" \[[xorl 2009|AA. Bibliography#xorl 2009] \] ["CVE-2008-1517: Apple Mac OS X (XNU) Missing Array Index Validation"|http://xorl.wordpress.com/2009/06/09/cve-2008-1517-apple-mac-os-x-xnu-missing-array-index-validation/] |
...