Use of Pointer Subtraction to Determine Size
Weakness ID: 469 (Weakness Base)Status: Draft
+ Description

Description Summary

The application subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
+ Time of Introduction
  • Implementation
+ Applicable Platforms

Languages

C

C++

+ Common Consequences
ScopeEffect
Authorization

There is the potential for arbitrary code execution with privileges of the vulnerable program.

+ Likelihood of Exploit

Medium

+ Potential Mitigations

Pre-design through Build: Most static analysis programs should be able to catch these errors.

Phase: Implementation

Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to "walk" from one pointer to the other and calculate the difference. Always sanity check this number.

+ Other Notes

These types of bugs generally are the result of a typo. Although most of them can easily be found when testing of the program, it is important that one correct these problems, since they almost certainly will break the code.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory465Pointer Issues
Development Concepts (primary)699
ChildOfWeakness ClassWeakness Class682Incorrect Calculation
Research Concepts (primary)1000
ChildOfCategoryCategory740CERT C Secure Coding Section 06 - Arrays (ARR)
Weaknesses Addressed by the CERT C Secure Coding Standard (primary)734
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CLASPImproper pointer subtraction
CERT C Secure CodingARR36-CDo not subtract or compare two pointers that do not refer to the same array
CERT C Secure CodingARR37-CDo not add or subtract an integer to a pointer to a non-array object
+ White Box Definitions

A weakness where code path has:

1. end statement that subtracts pointer1 from pointer2

2. start statement that associates pointer1 with a memory chunk1 and pointer2 to a memory chunk2

3. memory chunk1 is not equal to the memory chunk2

+ Content History
Submissions
Submission DateSubmitterOrganizationSource
CLASPExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-08-01KDM AnalyticsExternal
added/updated white box definitions
2008-09-08CWE Content TeamMITREInternal
updated Applicable Platforms, Common Consequences, Relationships, Other Notes, Taxonomy Mappings
2008-11-24CWE Content TeamMITREInternal
updated Relationships, Taxonomy Mappings
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Improper Pointer Subtraction
Back to top