CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
Description
The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath(), readlink(), PathAppend(), and others.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- IntegrityConfidentialityAvailability
Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart
Potential mitigations
- Implementation
Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.