CWE-469: Use of Pointer Subtraction to Determine Size
Use of Pointer Subtraction to Determine Size
Weakness ID: 469 (Weakness Base)
Status: Draft
Description
Description Summary
The application subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Common Consequences
Scope
Effect
Access Control
Integrity
Confidentiality
Availability
Technical Impact: Execute unauthorized code or
commands; Gain privileges / assume
identity
There is the potential for arbitrary code execution with privileges of
the vulnerable program.
Likelihood of Exploit
Medium
Potential Mitigations
Pre-design through Build: Most static analysis programs should be able
to catch these errors.
Phase: Implementation
Save an index variable. This is the recommended solution. Rather than
subtract pointers from one another, use an index variable of the same
size as the pointers in question. Use this variable to "walk" from one
pointer to the other and calculate the difference. Always sanity check
this number.
Other Notes
These types of bugs generally are the result of a typo. Although most of
them can easily be found when testing of the program, it is important that
one correct these problems, since they almost certainly will break the
code.
Description
