Use of Path Manipulation Function without Maximum-sized Buffer

Incomplete Variant

Structure: Simple

Description

This vulnerability occurs when a program uses a path manipulation function but supplies an output buffer that is too small to hold the maximum possible path length, such as PATH_MAX.

Extended Description

When functions like realpath(), readlink(), or PathAppend() are called with a buffer smaller than the maximum possible path size, a buffer overflow can happen. This overflow can corrupt adjacent memory, crash the application, or create opportunities for attackers to execute arbitrary code. To prevent this, developers should always ensure the output buffer for any path operation is sized to accommodate the system's maximum path length. Using dynamic allocation or verified, platform-specific constants for buffer size is a critical security practice during file and path operations.

Common Consequences 1

Scope: IntegrityConfidentialityAvailability

Impact: Modify MemoryExecute Unauthorized Code or CommandsDoS: Crash, Exit, or Restart

Potential Mitigations 1

Phase: Implementation

Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.

Demonstrative Examples 1

In this example the function creates a directory named "output\<name>" in the current directory and returns a heap-allocated copy of its name.

Code Example:Bad
C
c

For most values of the current directory and the name parameter, this function will work properly. However, if the name parameter is particularly long, then the second call to PathAppend() could overflow the outputDirectoryName buffer, which is smaller than MAX_PATH bytes.

References 1

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors

Katrina Tsipenyuk, Brian Chess, and Gary McGraw

NIST Workshop on Software Security Assurance Tools Techniques and Metrics • NIST

07-11-2005

https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf

ID: REF-6

Applicable Platforms

Languages:

C : UndeterminedC++ : Undetermined

Modes of Introduction

Implementation

Affected Resources

Memory
File or Directory

Related Weaknesses

ChildOf:

Use of Potentially Dangerous Function (CWE-676)

ChildOf:

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)

ChildOf:

Improper Input Validation (CWE-20)

Taxonomy Mapping

7 Pernicious Kingdoms
Software Fault Patterns

Notes

MaintenanceThis entry is at a much lower level of abstraction than most entries because it is function-specific. It also has significant overlap with other entries that can vary depending on the perspective. For example, incorrect usage could trigger either a stack-based overflow (Stack-based Buffer Overflow) or a heap-based overflow (Heap-based Buffer Overflow). The CWE team has not decided how to handle such entries.