Use of sizeof() on a Pointer Type

Opis

The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.

The use of sizeof() on a pointer can sometimes generate useful information. An obvious case is to find out the wordsize on a platform. More often than not, the appearance of sizeof(pointer) indicates a bug.

Skutki

• Integrity, Confidentiality

  Modify Memory; Read Memory

  This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.

Zapobieganie

• Implementation

  Use expressions such as "sizeof(*pointer)" instead of "sizeof(pointer)", unless you intend to run sizeof() on a pointer type to gain some platform independence or if you are allocating a variable on the stack.

Słabość nadrzędna

• CWE-131 Incorrect Calculation of Buffer Size

Kiedy powstaje

• Implementation

Dotyczy

C, C++

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. EXP01-A. Do not take the sizeof a pointer to determine the size of a type — Robert Seacord