When performing pointer arithmetic, the size of the computation is automatically scaled to the size of the pointer type. For instance, a pointer to a four-byte integer will be scaled by four bytes at a time.
Improper use of pointer arithmetic can lead to miscalculations that result in subtle and hard to spot coding errors.
Non-Compliant Code Example
In this example, taken from dowd,
int buf[1024];
int *buf_ptr = buf;
while (havedata() && buf_ptr < buf + sizeof(buf))
{
*buf_ptr = parseint(getdata());
buf_ptr++;
}
While at first look this code appears correct and that it will prevent overflowing the allocated buffer, in fact buf + sizeof(buf) returns a value corresponding to a region in memory beyond the allocated buffer. This is due to buf being an int pointer and the result of sizeof(buf) getting multiplied by sizeof(int) accordingly. Thus, this code is vulnerable to buffer overflow.
Compliant Code Examples
1)
int buf[BUF_LEN];
int *buf_ptr = buf;
while (havedata() && buf_ptr < buf[BUF_LEN-1])
{
*buf_ptr = parseint(getdata());
buf_ptr++;
}
2)
int buf[1024];
int *b = buf;
while (havedata() && b < buf+sizeof(buf))
{
*b++ = parseint(getdata());
}
These corrected versions:
- eliminate the coding error of the original code
- maintain clarity of intended result while reading code
Risk Analysis
Failure to notice a coding error of this variety would easily become a buffer overflow vulnerability. In a worst case scenario this could lead to arbitrary code execution and thus hold severe risk.