[Forgot Password]
Login  Register Subscribe












Paid content will be excluded from the download.

Download | Alert*
view XML

Buffer Access Using Size of Source Buffer

ID: 806Date: (C)2012-05-14   (M)2012-11-08
Type: weaknessStatus: INCOMPLETE
Abstraction Type: Variant


The software uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

Extended Description

When the size of the destination is smaller than the size of the source, a buffer overflow could occur.

Likelihood of Exploit: Medium to High

Applicable Platforms
Language: C
Language: Sometimes
Language: C++
Language: Sometimes

Time Of Introduction

  • Implementation

Common Consequences

ScopeTechnical ImpactNotes
DoS: crash / exit / restart
DoS: resource consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Execute unauthorized code or commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
Bypass protection mechanism
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Detection Methods

Potential Mitigations

Architecture and Design
 Use an abstraction library to abstract away risky APIs. Examples include the Safe C String Library (SafeStr) by Viega, and the Strsafe.h library from Microsoft. This is not a complete solution, since many buffer overflows are not related to strings.
Build and Compilation
 Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. This is not necessarily a complete solution, since these canary-based mechanisms only detect certain types of overflows. In addition, the result is still a denial of service, since the typical response is to exit the application.
 Programmers should adhere to the following rules when allocating and managing their applications memory: Double check that your buffer is as large as you specify. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space. Truncate all input strings to a reasonable length before passing them to the copy and concatenation functions
Environment Hardening
Use a feature like Address Space Layout Randomization (ASLR) [R.806.3] [R.806.5].
Defense in Depth
This is not a complete solution. However, it forces the attacker to guess an unknown value that changes every program execution. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.
Environment Hardening
Use a CPU and operating system that offers Data Execution Protection (NX) or its equivalent [R.806.5] [R.806.6].
Defense in Depth
This is not a complete solution, since buffer overflows could be used to overwrite nearby variables to modify the software's state in dangerous ways. In addition, it cannot be used in cases in which self-modifying code is required. Finally, an attack could still cause a denial of service, since the typical response is to exit the application.
Build and Compilation
 Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.


Related CWETypeViewChain
CWE-806 ChildOf CWE-805 Weakness CWE-1000

Demonstrative Examples   (Details)

  1. In the following example, the source character string is copied to the dest character string using the method strncpy.
  2. In this example, the method outputFilenameToLog outputs a filename to a log file. The method arguments include a pointer to a character string containing the file name and an integer for the number of characters in the string. The filename is copied to a buffer where the buffer size is set to a maximum size for inputs to the log file. The method then calls another method to save the contents of the buffer to the log file.

White Box Definitions

Black Box Definitions

Taxynomy Mappings


  1. Microsoft .Using the Strsafe.h Functions.
  2. Matt Messier John Viega .Safe C String Library v1.0.3.
  3. Michael Howard .Address Space Layout Randomization in Windows Vista.
  4. Arjan van de Ven .Limiting buffer overflows with ExecShield.
  5. .PaX.
  6. Microsoft .Understanding DEP as a mitigation technology part 1.

© 2013 SecPod Technologies