CWE-467: Use of sizeof() on a Pointer Type
Description
The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
The use of sizeof() on a pointer can sometimes generate useful information. An obvious case is to find out the wordsize on a platform. More often than not, the appearance of sizeof(pointer) indicates a bug.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- High
- Status
- Draft
Common consequences
- IntegrityConfidentiality
Modify Memory; Read Memory
This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.
Potential mitigations
- Implementation
Use expressions such as sizeof(*pointer) instead of sizeof(pointer), unless you intend to run sizeof() on a pointer type to gain some platform independence or if you are allocating a variable on the stack.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.