CWE-469
Use of Pointer Subtraction to Determine Size
Description
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
Parent Weaknesses (ChildOf)
Common Consequences
Scope
Impact
Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity
Potential Mitigations
Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to "walk" from one pointer to the other and calculate the difference. Always validate this number.
Applicable Platforms
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now