Difference between revisions of "Illegal Pointer Value"

From OWASP
Jump to: navigation, search
 
(Contents provided by Fortify.)
Line 1: Line 1:
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
 +
{{Template:Fortify}}
 +
 +
==Abstract==
 +
 +
This function can return a pointer to memory outside of the buffer to be searched. Subsequent operations on the pointer may have unintended consequences.
  
 
==Description==
 
==Description==
  
==Examples ==
+
This function can return a pointer to memory outside the bounds of the buffer to be searched under either of the following circumstances:
 +
 
 +
* An attacker can control the contents of the buffer to be searched
 +
* An attacker can control the value for which to search
 +
 
 +
==Examples==
 +
 
 +
The following short program uses an untrusted command line argument as the search buffer in a call to rawmemchr().
 +
 
 +
<pre>
 +
int main(int argc, char** argv) {
 +
  char* ret = rawmemchr(argv[0], 'x');
 +
  printf("%s\n", ret);
 +
}
 +
<pre>
 +
 
 +
The program is meant to print a substring of argv[0], but it may end up printing some portion of memory above argv[0].
 +
 
 +
This issue is similar to a string termination error, where the programmer relies on a character array to contain a null terminator.
  
 
==Related Threats==
 
==Related Threats==
Line 10: Line 33:
  
 
==Related Vulnerabilities==
 
==Related Vulnerabilities==
 +
 +
[[Buffer overflow]]
  
 
==Related Countermeasures==
 
==Related Countermeasures==
  
 
==Categories==
 
==Categories==
 
{{Template:Stub}}
 
  
 
[[Category:Implementation]]
 
[[Category:Implementation]]
 
 
[[Category:C]]
 
[[Category:C]]
 
+
[[Category:Code Snippet]]
 
[[Category:Range and Type Errors]]
 
[[Category:Range and Type Errors]]

Revision as of 11:40, 24 July 2006

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


This article includes content generously donated to OWASP by Fortify.JPG.

Abstract

This function can return a pointer to memory outside of the buffer to be searched. Subsequent operations on the pointer may have unintended consequences.

Description

This function can return a pointer to memory outside the bounds of the buffer to be searched under either of the following circumstances:

  • An attacker can control the contents of the buffer to be searched
  • An attacker can control the value for which to search

Examples

The following short program uses an untrusted command line argument as the search buffer in a call to rawmemchr().

	int main(int argc, char** argv) {
	  char* ret = rawmemchr(argv[0], 'x');
	  printf("%s\n", ret);
	} 
<pre>

The program is meant to print a substring of argv[0], but it may end up printing some portion of memory above argv[0].

This issue is similar to a string termination error, where the programmer relies on a character array to contain a null terminator.

==Related Threats==

==Related Attacks==

==Related Vulnerabilities==

[[Buffer overflow]]

==Related Countermeasures==

==Categories==

[[Category:Implementation]]
[[Category:C]]
[[Category:Code Snippet]]
[[Category:Range and Type Errors]]