When performing pointer arithmetic, the size of the value to add to a pointer is automatically scaled to the size of the type of the pointed-to object. For instance, when adding a value to the byte address of a 4-byte integer, the value is scaled by a factor 4 and then added to the pointer. Failing to understand how pointer arithmetic works can lead to miscalculations that result in serious errors, such as buffer overflows.
Noncompliant Code Example
| Wiki Markup |
|---|
In this noncompliant code example, integer values returned by {{parseint(getdata())}} are stored into an array of {{INTBUFSIZE}} elements of type {{int}} called {{buf}} \[[Dowd 06|AA. C References#Dowd 06]\]. If data is available for insertion into {{buf}} (which is indicated by {{havedata()}}) and {{buf_ptr}} has not been incremented past {{buf + sizeof(buf)}}, an integer value is stored at the address referenced by {{buf_ptr}}. However, the {{sizeof}} operator returns the total number of bytes in {{buf}}, which is typically a multiple of the number of elements in {{buf}}. This value is scaled to the size of an integer and added to {{buf}}. As a result, the check to make sure integers are not written past the end of {{buf}} is incorrect and a buffer overflow is possible. |
| Code Block | ||
|---|---|---|
| ||
int buf[INTBUFSIZE];
int *buf_ptr = buf;
while (havedata() && buf_ptr < (buf + sizeof(buf))) {
*buf_ptr++ = parseint(getdata());
}
|
Compliant Solution
In this compliant solution, the size of buf is added directly to buf and used as an upper bound. The integer literal is scaled to the size of an integer and the upper bound of buf is checked correctly.
| Code Block | ||
|---|---|---|
| ||
int buf[INTBUFSIZE];
int *buf_ptr = buf;
while (havedata() && buf_ptr < (buf + INTBUFSIZE)) {
*buf_ptr++ = parseint(getdata());
}
|
An arguably better solution is to use the address of the nonexistent element following the end of the array as follows:
| Code Block | ||
|---|---|---|
| ||
int buf[INTBUFSIZE];
int *buf_ptr = buf;
while (havedata() && buf_ptr < &buf[INTBUFSIZE] {
*buf_ptr++ = parseint(getdata());
}
|
| Wiki Markup |
|---|
This works because C99 guarantees the address of {{buf\[INTBUFSIZE\]}} even though no such element exists. |
Noncompliant Code Example
The following example is based on a flaw in the OpenBSD operating system. An integer, skip, is added as an offset to a pointer of type struct big. The adjusted pointer is then used as a destination address in a call to memset(). However, when skip is added to the struct big pointer, it is automatically scaled by the size of struct big, which is 32 bytes (assuming 4-byte integers, 8-byte long long integers, and no structure padding). This results in the call to memset() writing to unintended memory.
| Code Block | ||
|---|---|---|
| ||
struct big {
unsigned long long ull_1; /* typically 8 bytes */
unsigned long long ull_2; /* typically 8 bytes */
unsigned long long ull_3; /* typically 8 bytes */
int si_4; /* typically 4 bytes */
int si_5; /* typically 4 bytes */
};
/* ... */
size_t skip = offsetof(struct big, ull_2);
struct big *s = (struct big *)malloc(sizeof(struct big));
if (!s) {
/* Handle malloc() error */
}
memset(s + skip, 0, sizeof(struct big) - skip);
/* ... */
free(s);
s = NULL;
|
| Wiki Markup |
|---|
A similar situation occurred in OpenBSD's {{make}} command \[[Murenin 07|AA. C References#Murenin 07]\]. |
Compliant Solution
To correct this example, the struct big pointer is cast as a char *. This causes skip to be scaled by a factor of 1.
| Code Block | ||
|---|---|---|
| ||
struct big {
unsigned long long ull_1; /* typically 8 bytes */
unsigned long long ull_2; /* typically 8 bytes */
unsigned long long ull_3; /* typically 8 bytes */
int si_4; /* typically 4 bytes */
int si_5; /* typically 4 bytes */
};
/* ... */
size_t skip = offsetof(struct big, ull_2);
struct big *s = (struct big *)malloc(sizeof(struct big));
if (!s) {
/* Handle malloc() error */
}
memset((char *)s + skip, 0, sizeof(struct big) - skip);
/* ... */
free(s);
s = NULL;
|
Risk Assessment
Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP08-C | high | probable | high | P6 | L2 |
Automated Detection
How long is 4 yards plus 3 feet? It is obvious from elementary arithmetic that any answer involving '7' is wrong, as the student did not take the units into account. The right method is to convert both numbers to reflect the same units.
The examples in this rule reflect both a correct and wrong way to handle comparisons of numbers representing different things (either single bytes or multibyte data structures). The NCEs just add the numbers without regard to units, whereas the compliant solutions use type casts to convert one number to the appropriate unit of the other number.
ROSE can catch both NCE's by searching for pointer arithmetic expressions involving different units. The 'different units' is the tricky part, but one can try to identify an expression's units using some simple heuristics:
- A pointer to a 'foo' object has 'foo' as the unit.
- A pointer to
char *has unit 'byte'. - Any
sizeoforoffsetofexpression also has unit 'byte'. Wiki Markup Any variable used in an index to an array of {{foo}} objects (eg {{foo\[variable\]}}) has '{{foo}}' as the unit.
| Wiki Markup |
|---|
In addition to pointer arithmetic expressions, one can also hunt for array index expressions, as {{array\[index\]}} is merely shorthand for '{{array + index}}'. But programmers are more likely to use {{\[\]}} with correct units than use pointer arithmetic with proper units. |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
This rule appears in the C++ Secure Coding Standard as EXP08-CPP. Ensure pointer arithmetic is used correctly.
References
| Wiki Markup |
|---|
\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 6, "C Language Issues" \[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "HFC Pointer casting and pointer type changes" and "RVG Pointer Arithmetic" \[[MISRA 04|AA. C References#MISRA 04]\] Rules 17.1-17.4 \[[MITRE 07|AA. C References#MITRE 07]\] [CWE ID 468|http://cwe.mitre.org/data/definitions/468.html], "Incorrect Pointer Scaling" \[[Murenin 07|AA. C References#Murenin 07]\] |