Difference between revisions of "Illegal Pointer Value"

From OWASP
Jump to: navigation, search
Line 2: Line 2:
 
{{Template:Fortify}}
 
{{Template:Fortify}}
  
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+
__TOC__
  
 +
[[ASDR Table of Contents]]
  
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 
  
[[ASDR Table of Contents]]
+
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
__TOC__
+
  
  
Line 103: Line 102:
 
[[Category:Code Snippet]]
 
[[Category:Code Snippet]]
 
[[Category:Range and Type Error Vulnerability]]
 
[[Category:Range and Type Error Vulnerability]]
 +
[[Category:Vulnerability]]

Revision as of 08:39, 2 November 2008

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


This article includes content generously donated to OWASP by Fortify.JPG.

Contents


ASDR Table of Contents

Last revision (mm/dd/yy): 11/2/2008


Description

This function can return a pointer to memory outside of the buffer to be searched. Subsequent operations on the pointer may have unintended consequences.

This function can return a pointer to memory outside the bounds of the buffer to be searched under either of the following circumstances:

  • An attacker can control the contents of the buffer to be searched
  • An attacker can control the value for which to search


Risk Factors

TBD

Examples

The following short program uses an untrusted command line argument as the search buffer in a call to rawmemchr().

	int main(int argc, char** argv) {
	  char* ret = rawmemchr(argv[0], 'x');
	  printf("%s\n", ret);
	} 

The program is meant to print a substring of argv[0], but it may end up printing some portion of memory above argv[0].

This issue is similar to a string termination error, where the programmer relies on a character array to contain a null terminator.


Related Attacks


Related Vulnerabilities

Related Controls


Related Technical Impacts


References

TBD