CWE-469 – Use of Pointer Subtraction to Determine Size

Read Time:40 Second

Description

The application subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

Modes of Introduction:

– Implementation

 

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-682

 

Consequences

Access Control, Integrity, Confidentiality, Availability: Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

There is the potential for arbitrary code execution with privileges of the vulnerable program.

 

Potential Mitigations

Phase: Implementation

Description: 

Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to “walk” from one pointer to the other and calculate the difference. Always validate this number.

CVE References