CWE-785 路径操作函数中使用未进行大小限定的缓冲区

Use of Path Manipulation Function without Maximum-sized Buffer

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

The software invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.

扩展描述

Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath(), readlink(), PathAppend(), and others.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 676 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 120 cwe_View_ID: 1000

  • cwe_Nature: ChildOf cwe_CWE_ID: 120 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 20 cwe_View_ID: 700 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 20 cwe_View_ID: 699

适用平台

Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Undetermined'}, {'cwe_Name': 'C++', 'cwe_Prevalence': 'Undetermined'}]

常见的影响

范围 影响 注释
['Integrity', 'Confidentiality', 'Availability'] ['Modify Memory', 'Execute Unauthorized Code or Commands', 'DoS: Crash, Exit, or Restart']

可能的缓解方案

Implementation

策略:

Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.

示例代码

例

In this example the function creates a directory named "output\" in the current directory and returns a heap-allocated copy of its name.

bad C

char createOutputDirectory(char name) {
char outputDirectoryName[128];
if (getCurrentDirectory(128, outputDirectoryName) == 0) {
return null;
}
if (!PathAppend(outputDirectoryName, "output")) {
return null;
}
if (!PathAppend(outputDirectoryName, name)) {

return null;
}
if (SHCreateDirectoryEx(NULL, outputDirectoryName, NULL) != ERROR_SUCCESS) {

return null;
}
return StrDup(outputDirectoryName);
}

For most values of the current directory and the name parameter, this function will work properly. However, if the name parameter is particularly long, then the second call to PathAppend() could overflow the outputDirectoryName buffer, which is smaller than MAX_PATH bytes.

Notes

Maintenance Much of this entry was originally part of CWE-249, which was deprecated for several reasons. Maintenance This entry is at a much lower level of abstraction than most entries because it is function-specific. It also has significant overlap with other entries that can vary depending on the perspective. For example, incorrect usage could trigger either a stack-based overflow (CWE-121) or a heap-based overflow (CWE-122). The CWE team has not decided how to handle such entries.

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
7 Pernicious Kingdoms Often Misused: File System
Software Fault Patterns SFP9 Faulty String Expansion