Page History

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-119 and EXP39-C

Independent( ARR30-C, ARR38-C, ARR32-C, INT30-C, INT31-C, EXP39-C, EXP33-C, FIO37-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

Intersection( EXP39-C, CWE-119) =

• Reading memory assigned to one type, but being accessed through a pointer to a larger type.

EXP39-C – CWE-119 =

• Writing to memory assigned to one type, but accessed through a pointer to a larger type

• Reading memory assigned to one type, but being accessed through a pointer to a smaller (or equal-sized) type

CWE-119 – EXP39-C =

• Reading beyond a buffer using a means other than accessing a variable through an incompatible pointer.

CWE-123

...

and EXP39-C

Intersection( CWE-123, EXP39-C) = Ø

EXP39-C allows overflowing a (small) buffer, but not arbitrary memory writes. (Possibly an arbitrary-memory write exploit could be devised using a “perfect storm” of incompatible types, but this would be uncommon in practice.)

CWE-125 and EXP39-C

Independent( ARR30-C, ARR38-C, EXP39-C, INT30-C) STR31-C = Subset( Union( ARR30-C, ARR38-C)) STR32-C = Subset( ARR38-C)

Intersection( EXP39-C, CWE-125) =

• Reading memory assigned to one type, but being accessed through a pointer to a larger type.

ESP39-C – CWE-125 =

• Reading memory assigned to one type, but being accessed through a pointer to a smaller (or equal-sized) type

CWE-125 – EXP39-C =

• Reading beyond a buffer using a means other than accessing a variable through an incompatible pointer.

CWE-188 and EXP39-C

Intersection( CWE-188, EXP39-C) = Ø

CWE-188 appears to be about making assumptions about the layout of memory between distinct variables (that are not part of a larger struct or array). Such assumptions typically involve pointer arithmetic (which violates ARR30-C). EXP39-C involves only one object in memory being (incorrectly) interpreted as if it were another object. EG a float being treated as an int (usually via pointers and typecasting)

CWE-704 and EXP39-C

CWE-704 = Union( EXP39-C, list) where list =

• Incorrect (?) typecast that is not incompatible

Bibliography

...