Access of Memory Location Before Start of Buffer
This vulnerability occurs when software attempts to read from or write to a memory location positioned before the official start of a buffer.
This flaw, often called a 'buffer under-read' or 'under-write,' happens when a pointer or index is incorrectly positioned. Common triggers include decrementing a pointer beyond the buffer's first element, performing pointer arithmetic that steps back too far, or directly using a negative index value to access array-like structures. Accessing memory before a buffer's valid range can lead to unpredictable behavior. It may read sensitive data from unrelated parts of memory, corrupt critical program state, or cause an immediate crash, creating opportunities for denial-of-service or information disclosure attacks.
Impact: Read Memory
For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffer's position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Impact: Modify MemoryDoS: Crash, Exit, or Restart
Out of bounds memory access will very likely result in the corruption of relevant memory, and perhaps instructions, possibly leading to a crash.
Impact: Modify MemoryExecute Unauthorized Code or Commands
If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code. If the corrupted memory is data rather than instructions, the system will continue to function with improper changes, possibly in violation of an implicit or explicit policy.
ID : DX-87
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.Code Example:
c// copy input string to a temporary string* char message[length+1]; int index; for (index = 0; index < length; index++) { ``` message[index] = strMessage[index]; } message[index] = '\0';
c// return string without trailing whitespace* retMessage = message; return retMessage;}
ID : DX-90
The following example asks a user for an offset into an array to select an item.Code Example:
cID : DX-88
The following is an example of code that may result in a buffer underwrite. This code is attempting to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by using the function strstr(), which returns a pointer to the found substring in destBuf. Using pointer arithmetic, the starting index of the substring is found.Code Example:
c- Memory Management
- Memory
- CERT C Secure Coding