CWE-469: Use of Pointer Subtraction to Determine Size
Description
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Medium
- Status
- Draft
Common consequences
- Access ControlIntegrityConfidentialityAvailability
Modify Memory; Read Memory; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
There is the potential for arbitrary code execution with privileges of the vulnerable program.
Potential mitigations
- Implementation
Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to walk from one pointer to the other and calculate the difference. Always validate this number.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.