Page History

When performing pointer arithmetic, the size of the value to add to a pointer is automatically scaled to the size of the pointer's typetype of the pointed-to object. For instance, when adding a value to a pointer to a fourthe byte address of a 4-byte integer, the value is scaled by a factor of four of 4 and then added to the pointer. Failing to understand how pointer arithmetic works can lead to miscalculations that result in serious errors, such as buffer overflows.

...

Noncompliant Code Example

...

In this non-compliant noncompliant code example derived from \[[Dowd|AA. C References#Dowd 06]\], integer values returned by {{parseint(getdata())}} are stored into an array of {{INTBUFSIZE}} elements of type {{int}} called {{buf}}. If data is available for insertion into {{buf}} (which is indicated by {{havedata()}}) and {{buf_ptr}} has not been incremented past {{buf + sizeof(buf)}}, an integer value is stored at the address referenced by {{buf_ptr}}. However, the {{sizeof}} operator returns the total number of bytes in {{buf}} which is typically a multiple of the number of elements in {{buf}}. This value is scaled to the size of an integer and added to {{buf}}. As a result, the check to make sure integers are not written past the end of {{buf}} is incorrect and a buffer overflow is buf [Dowd 2006]. If data is available for insertion into buf (which is indicated by havedata()) and buf_ptr has not been incremented past buf + sizeof(buf), an integer value is stored at the address referenced by buf_ptr. However, the sizeof operator returns the total number of bytes in buf, which is typically a multiple of the number of elements in buf. This value is scaled to the size of an integer and added to buf. As a result, the check to make sure integers are not written past the end of buf is incorrect, and a buffer overflow is possible.

Code Block
bgColor #FFCCCC lang c
int buf[INTBUFSIZE]; int *buf_ptr = buf; while (havedata() && buf_ptr < (buf + sizeof(buf))) { *buf_ptr++ = parseint(getdata()); }

Compliant Solution

...

In this compliant solution, the size of buf, INTBUFSIZE, is added directly to buf and used as an upper bound. The integer literal INTBUFSIZE is scaled to the size of an integer, and the upper bound of buf is checked correctly.

Code Block
bgColor #CCCCFF lang c
int buf[INTBUFSIZE]; int *buf_ptr = buf; while (havedata() && buf_ptr < (buf + INTBUFSIZE)) { *buf_ptr++ = parseint(getdata()); }

An arguably better solution is to use the address of the nonexistent element following the end of the array, as follows:

Code Block
bgColor #CCCCFF lang c
int buf[INTBUFSIZE]; int *buf_ptr = buf; while (havedata() && buf_ptr < &buf[INTBUFSIZE]) { *buf_ptr++ = parseint(getdata()); }

Non-Compliant Code Example 2

This solution works because the C Standard guarantees the address of buf[INTBUFSIZE] even though no such element exists.

Noncompliant Code Example

This noncompliant code The following example is based on a flaw in the OpenBSD operating system. An integer, skip, is added as an offset to a pointer of type struct big. The adjusted pointer is then used as a destination address in a call to memset(). However, when skip }} is added to the {{struct big pointer, it is automatically scaled by the size of struct big, which is 32 bytes (assuming 4-byte integers, 8-byte long long integers, and no structure padding). This scaling results in the call to memset() writing to unintended memory.

struct big {
    unsigned long long ull_1; /* typicallyTypically 8 bytes */
    unsigned long long ull_2; /* typicallyTypically 8 bytes */
    unsigned long long ull_3; /* typicallyTypically 8 bytes */
    int si_4; /* typicallyTypically 4 bytes */
    int si_5; /* typicallyTypically 4 bytes */
};
/* ... */
 
int f(void) {
  size_t skip = sizeofoffsetof(unsignedstruct long longbig, ull_2);
  struct big *s = (struct big *)malloc(sizeof(struct big));
  if (!s) {
   return -1; /* HandleIndicate malloc() errorfailure */
  }

  memset(s + skip, 0, sizeof(struct big) - skip);
  /* ... */
  free(s);
  s = NULL;
  
  return 0;
}

A similar situation occurred in OpenBSD's make command [Murenin 2007].

Compliant Solution

...

To correct this example, the struct big pointer is cast as a char *. This , which causes skip_member to be scaled by a factor of 1.:

Code Block
bgColor #CCCCFF lang c
struct big { unsigned long long ull_1; /* typicallyTypically 8 bytes */ unsigned long long ull_2; /* typicallyTypically 8 bytes */ unsigned long long ull_3; /* typicallyTypically 8 bytes */ int si_4; /* typicallyTypically 4 bytes */ int si_5; /* typicallyTypically 4 bytes */ }; /* ... */   int f(void) { size_t skip = sizeofoffsetof(unsignedstruct long longbig, ull_2); struct big *s = (struct big *)malloc(sizeof(struct big)); if (!s) { return -1; /* HandleIndicate malloc() errorfailure */ } memset((char *)s + skip, 0, sizeof(struct big) - skip); /* ... */ free(s); s = NULL; return 0; }

Risk Assessment

Failure to understand and properly use pointer arithmetic can allow an attacker to execute arbitrary code.

Automated Detection

How long is 4 yards plus 3 feet? It is obvious from elementary arithmetic that any answer involving 7 is wrong, as the student did not take the units into account. The right method is to convert both numbers to reflect the same units.

The examples in this rule reflect both a correct and an incorrect way to handle comparisons of numbers representing different things (either single bytes or multibyte data structures). The noncompliant examples just add the numbers without regard to units, whereas the compliant solutions use type casts to convert one number to the appropriate unit of the other number.

ROSE can catch both noncompliant examples by searching for pointer arithmetic expressions involving different units. The "different units" is the tricky part, but you can try to identify an expression's units using some simple heuristics:

• A pointer to a foo object has foo as the unit.
• A pointer to char * has byte as the unit.
• Any sizeof or offsetof expression also has unit byte as the unit.
• Any variable used in an index to an array of foo objects (e.g., foo[variable]) has foo as the unit.

In addition to pointer arithmetic expressions, you can also hunt for array index expressions, as array[index] is merely shorthand for "array + index."

Related Vulnerabilities

Search for Examples of vulnerabilities resulting from the violation of this rule can be found on the CERT website.

Reference

Related Guidelines

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[[Dowd|AA. C References#Dowd 06]\] Chapter 6, "C Language Issues" (Vulnerabilities) \[[cnst: 10-year-old pointer-arithmetic bug in make(1) is now gone, thanks to malloc.conf and some debugging|http://cnst.livejournal.com/24040.html]\]