Use of Path Manipulation Function without Maximum-sized Buffer

Opis

The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.

Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath(), readlink(), PathAppend(), and others.

Skutki

• Integrity, Confidentiality, Availability

  Modify Memory; Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart

Zapobieganie

• Implementation

  Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.

Słabość nadrzędna

• CWE-676 Use of Potentially Dangerous Function
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-20 Improper Input Validation

Kiedy powstaje

• Implementation

Dotyczy

C, C++

Uwagi

This entry is at a much lower level of abstraction than most entries because it is function-specific. It also has significant overlap with other entries that can vary depending on the perspective. For example, incorrect usage could trigger either a stack-based overflow (CWE-121) or a heap-based overflow (CWE-122). The CWE team has not decided how to handle such entries.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005