All integer values originating from untrusted sources should be evaluated to determine if there are identifiable upper and lower bounds. If so, these limits should be enforced by the interface. Restricting the input of excessively large or small integers helps prevent overflow, truncation, and other type range errors. Furthermore, it is easier to find and correct input problems than it is to trace internal errors back to faulty inputs.
...
Noncompliant Code Example
In the following non-compliant noncompliant code example, length is a user-supplied argument that is used to determine the length of table.
...
Because length is user controlled, the value can result in a large block of memory being allocated or cause the call to malloc() to fail. Depending on how error handling is implemented, this may result in a denial of service or other error. A length of zero results in a division by zero in the overflow check, which can also result in a denial of service (see INT33-C. Ensure that division and modulo operations do not result in divide-by-zero errors).
Compliant Solution
| Wiki Markup |
|---|
This compliant solution defines the acceptable range for {{length}} as {{\[1, MAX_TABLE_LENGTH\]}}. The {{length}} parameter is declared as {{size_t}}, which is unsigned by definition. Consequently, it is not necessary to check {{length}} for negative values (see [INT01-C. Use rsize_t or size_t for all integer values representing the size of an object]). |
...
The test for length == 0 ensures that a non-zero number of bytes is allocated (see MEM04-AC. Do not perform zero length allocations).
Risk Assessment
Failing to enforce the limits on integer values can result in a denial-of-service attack.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
INT04-A C | low | probable | high | P2 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Seacord 05a|AA. C References#Seacord 05]\] Chapter 5, "Integer Security" |
...
INT03-C. Use a secure integer library 04. Integers (INT) INT05-A. Do not use input functions to convert character data if they cannot handle all possible inputs