Difference between revisions of "Illegal Pointer Value"

From OWASP
Jump to: navigation, search
 
 
(7 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
 +
{{Template:Fortify}}
 +
 +
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 +
 +
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
  
 
==Description==
 
==Description==
  
==Examples ==
+
This function can return a pointer to memory outside of the buffer to be searched. Subsequent operations on the pointer may have unintended consequences.
  
==Related Threats==
+
This function can return a pointer to memory outside the bounds of the buffer to be searched under either of the following circumstances:
  
==Related Attacks==
+
* An attacker can control the contents of the buffer to be searched
 +
* An attacker can control the value for which to search
  
==Related Vulnerabilities==
 
  
==Related Countermeasures==
+
==Risk Factors==
  
==Categories==
+
TBD
  
{{Template:Stub}}
+
==Examples==
  
[[Category:Implementation]]
+
The following short program uses an untrusted command line argument as the search buffer in a call to rawmemchr().
  
[[Category:C]]
+
<pre>
 +
int main(int argc, char** argv) {
 +
  char* ret = rawmemchr(argv[0], 'x');
 +
  printf("%s\n", ret);
 +
}
 +
</pre>
  
[[Category:Range and Type Errors]]
+
The program is meant to print a substring of argv[0], but it may end up printing some portion of memory above argv[0].
 +
 
 +
This issue is similar to a string termination error, where the programmer relies on a character array to contain a null terminator.
 +
 
 +
 
 +
==Related [[Attacks]]==
 +
 
 +
* [[Attack 1]]
 +
* [[Attack 2]]
 +
 
 +
 
 +
==Related [[Vulnerabilities]]==
 +
 
 +
* [[Buffer Overflow]]
 +
 
 +
==Related [[Controls]]==
 +
 
 +
* [[Control 1]]
 +
* [[Control 2]]
 +
 
 +
 
 +
==Related [[Technical Impacts]]==
 +
 
 +
* [[Technical Impact 1]]
 +
* [[Technical Impact 2]]
 +
 
 +
 
 +
==References==
 +
 
 +
TBD
 +
 
 +
[[Category:FIXME|add links
 +
 
 +
In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
 +
 
 +
Availability Vulnerability
 +
 
 +
Authorization Vulnerability
 +
 
 +
Authentication Vulnerability
 +
 
 +
Concurrency Vulnerability
 +
 
 +
Configuration Vulnerability
 +
 
 +
Cryptographic Vulnerability
 +
 
 +
Encoding Vulnerability
 +
 
 +
Error Handling Vulnerability
 +
 
 +
Input Validation Vulnerability
 +
 
 +
Logging and Auditing Vulnerability
 +
 
 +
Session Management Vulnerability]]
 +
 
 +
__NOTOC__
 +
 
 +
 
 +
[[Category:OWASP ASDR Project]]
 +
[[Category:Implementation]]
 +
[[Category:C]]
 +
[[Category:Code Snippet]]
 +
[[Category:Range and Type Error Vulnerability]]
 +
[[Category:Vulnerability]]

Latest revision as of 20:15, 20 February 2009

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


This article includes content generously donated to OWASP by Fortify.JPG.

Last revision (mm/dd/yy): 02/20/2009

Vulnerabilities Table of Contents

Description

This function can return a pointer to memory outside of the buffer to be searched. Subsequent operations on the pointer may have unintended consequences.

This function can return a pointer to memory outside the bounds of the buffer to be searched under either of the following circumstances:

  • An attacker can control the contents of the buffer to be searched
  • An attacker can control the value for which to search


Risk Factors

TBD

Examples

The following short program uses an untrusted command line argument as the search buffer in a call to rawmemchr().

	int main(int argc, char** argv) {
	  char* ret = rawmemchr(argv[0], 'x');
	  printf("%s\n", ret);
	} 

The program is meant to print a substring of argv[0], but it may end up printing some portion of memory above argv[0].

This issue is similar to a string termination error, where the programmer relies on a character array to contain a null terminator.


Related Attacks


Related Vulnerabilities

Related Controls


Related Technical Impacts


References

TBD