Improper Validation of Array Index
This vulnerability occurs when software uses unverified, external input to calculate or access an array index, without properly checking that the index points to a valid location within the array's bounds.
At its core, this weakness is about a failure to enforce boundaries. When a program trusts user-supplied data—like a number from a form, URL parameter, or network packet—to directly select an array element, it can lead to reading from or writing to memory outside the array's intended space. This often happens because developers assume the input will be within a safe range or rely on client-side validation that can be bypassed. The consequences are typically severe, enabling attacks like arbitrary memory access, program crashes, or code execution. To prevent this, developers must implement strict server-side validation, ensuring the index is not only the correct data type but also falls within the minimum and maximum bounds of the array (e.g., 0 <= index < array.length). Using safe languages, secure functions, or managed data structures that inherently check bounds is also a critical defensive practice.
Impact: DoS: Crash, Exit, or Restart
Use of an index that is outside the bounds of an array will very likely result in the corruption of relevant memory and perhaps instructions, leading to a crash, if the values are outside of the valid memory area.
Impact: Modify Memory
If the memory corrupted is data, rather than instructions, the system will continue to function with improper values.
Impact: Modify MemoryRead Memory
Use of an index that is outside the bounds of an array can also trigger out-of-bounds read or write operations, or operations on the wrong objects; i.e., "buffer overflows" are not always the result. This may result in the exposure or modification of sensitive data.
Impact: Execute Unauthorized Code or Commands
If the memory accessible by the attacker can be effectively controlled, it may be possible to execute arbitrary code, as with a standard buffer overflow and possibly without the use of large inputs if a precise index can be controlled.
Impact: DoS: Crash, Exit, or RestartExecute Unauthorized Code or CommandsRead MemoryModify Memory
A single fault could allow either an overflow (Access of Memory Location After End of Buffer) or underflow (Access of Memory Location Before Start of Buffer) of the array index. What happens next will depend on the type of operation being performed out of bounds, but can expose sensitive information, cause a system crash, or possibly lead to arbitrary code execution.
Strategy: Input Validation
Strategy: Language Selection
Strategy: Environment Hardening
Effectiveness: Defense in Depth
Strategy: Environment Hardening
Effectiveness: Defense in Depth
Strategy: Input Validation
Strategy: Environment Hardening
Strategy: Sandbox or Jail
Effectiveness: Limited
Code Example:
javaID : DX-34
The following example takes a user-supplied value to allocate an array of objects and then operates on the array.Code Example:
javaID : DX-100
In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the methodCode Example:
c// check that the array index is less than the maximum*
ccCode Example:
c// check that the array index is within the correct*
cID : DX-134
The following example retrieves the sizes of messages for a pop3 mail server. The message sizes are retrieved from a socket that returns in a buffer the message number and the message size, the message number (num) and size (size) are extracted from the buffer and the message size is placed into an array using the message number for the array index.Code Example:
/* capture the sizes of all messages / int getsizes(int sock, int count, int *sizes) { ``` ... char buf[BUFFER_SIZE]; int ok; int num, size;
c// continue read from socket until buf only contains '.'* if (DOTLINE(buf)) ``` break; else if (sscanf(buf, "%d %d", &num, &size) == 2) sizes[num - 1] = size; } ... }
Code Example:
/* capture the sizes of all messages / int getsizes(int sock, int count, int *sizes) { ``` ... char buf[BUFFER_SIZE]; int ok; int num, size;
c// continue read from socket until buf only contains '.'* if (DOTLINE(buf)) ``` break; else if (sscanf(buf, "%d %d", &num, &size) == 2) { if (num > 0 && num <= (unsigned)count) sizes[num - 1] = size; else
cID : DX-133
In the following example the method displayProductSummary is called from a Web service servlet to retrieve product summary information for display to the user. The servlet obtains the integer value of the product number from the user and passes it to the displayProductSummary method. The displayProductSummary method passes the integer value of the product number to the getProductSummary method which obtains the product summary from the array object containing the project summaries using the integer value of the product number as the array index.Code Example:
// Method called from servlet to obtain product information* public String displayProductSummary(int index) {
javaCode Example:
// Method called from servlet to obtain product information* public String displayProductSummary(int index) {
javaCode Example:
javaID : DX-90
The following example asks a user for an offset into an array to select an item.Code Example:
cHigh
out-of-bounds array index
index-out-of-range
array index underflow
- Memory Management
- Memory
- CLASP
- PLOVER
- CERT C Secure Coding
- CERT C Secure Coding
- CERT C Secure Coding
- CERT C Secure Coding
- SEI CERT Perl Coding Standard
- OMG ASCSM
- Software Fault Patterns