Missing parameter

Revision as of 20:10, 30 May 2009 by Deleted user (Talk | contribs)

Jump to: navigation, search

picture of food in australia index asian world cup [http://s1.shard.jp/olharder/auto-title-services.html auto mart usa ] [http://s1.shard.jp/olharder/44-auto-trader-nz.html autosomal recessive pedigree chart ] http [http://s1.shard.jp/olharder/general-motor.html auto roundup.com ] music therapy courses australia domain why do we have laws in australia [http://s1.shard.jp/frhorton/17h5odjs2.html african american marine corps generals ] [http://s1.shard.jp/bireba/eztrust-antivirus.html etrust antivirus 7.1 retail ] [http://s1.shard.jp/losaul/townsville-australia.html gutter guard australia ] [http://s1.shard.jp/losaul/real-estate.html european rabbit in australia ] [http://s1.shard.jp/losaul/wiremesh-australia.html australian bookmakers association ] [http://s1.shard.jp/bireba/nod-antivirus.html symantec antivirus 9.0.3 ] domain [http://s1.shard.jp/galeach/new67.html asian camel toe picture ] [http://s1.shard.jp/bireba/norton-antivirus.html reviews antivirus programs ] index [http://s1.shard.jp/frhorton/c1k98s3rt.html east african breweries ltd ] [http://s1.shard.jp/frhorton/lt8tyfnvp.html african americans and latinos ] [http://s1.shard.jp/frhorton/pp3b7gffd.html african honey bees ] the climate of africa [http://s1.shard.jp/frhorton/zedmbj3he.html movie nowhere in africa ] [http://s1.shard.jp/frhorton/1aql7wt5f.html africa cable rca south vga ] [http://s1.shard.jp/frhorton/91rryr9x4.html south african cricket tickets ] [http://s1.shard.jp/frhorton/xn61tpox7.html africa aids hiv in ] [http://s1.shard.jp/frhorton/j45p2foyu.html map of south africa in cry the beloved country ] [http://s1.shard.jp/losaul/western-plains.html park regis sydney australia ] [http://s1.shard.jp/frhorton/2u1ol1yan.html club africain ] [http://s1.shard.jp/olharder/wheels-and-deals.html grand theft auto car map ] [http://s1.shard.jp/losaul/australian-citizenship.html hervey bay hotel australia ] [http://s1.shard.jp/frhorton/a1q69qdt7.html african afro american hair style ] [http://s1.shard.jp/bireba/mcafee-free-antivirus.html norton internet security mac 30 antivirus firewall privacy ] [http://s1.shard.jp/frhorton/6znbfza3k.html olduvai gorge africa map ] african champions league 2005 results [http://s1.shard.jp/olharder/lisa-lopez-autopsy.html automobile dealer association ] [http://s1.shard.jp/olharder/ontegra-automotive.html autowatch immobiliser ] http [http://s1.shard.jp/bireba/symantec-antivirus.html avg antivirus crack 7.0.300 ] pangasianodon [http://s1.shard.jp/frhorton/qogtjly72.html labour law south africa overtime ] url [http://s1.shard.jp/olharder/internet-auto-part.html the autobiography of miss jane pittman the book ] stihl australia specials [http://s1.shard.jp/olharder/aa-auto-route-planner.html radiators auto ] [http://s1.shard.jp/frhorton/4lte5ty9r.html african american music france ] [http://s1.shard.jp/galeach/new94.html asian spices online ] This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

Last revision (mm/dd/yy): 05/30/2009

Vulnerabilities Table of Contents


If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.


  • Authorization: There is the potential for arbitrary code execution with privileges of the vulnerable program if the function parameter list is exhausted.
  • Availability: Potentially a program could fail if it needs more arguments then are available.

Exposure period

  • Implementation: This is a simple logical flaw created at implementation time.


  • Languages: C or C++
  • Operating platforms: Any

Required resources




Likelihood of exploit


This issue can be simply combated with the use of proper build process.

Risk Factors

  • Talk about the factors that make this vulnerability likely or unlikely to actually happen
  • Discuss the technical impact of a successful exploit of this vulnerability
  • Consider the likely [business impacts] of a successful attack


In C or C++:

foo_funct(one, two);

void foo_funct(int one, int two, int three) {
  printf("1) %d\n2) %d\n3) %d\n", one, two, three);

This can be exploited to disclose information with no work whatsoever. In fact, each time this function is run, it will print out the next 4 bytes on the stack after the two numbers sent to it.

Another example in C/C++ is:

void some_function(int foo, ...) {
    int a[3], i;
    va_list ap;

    va_start(ap, foo);
	for (i = 0;  i < sizeof(a) / sizeof(int);  i++)
        a[i] = va_arg(ap, int);

int main(int argc, char *argv[]) {
    some_function(17, 42);

Related Attacks

Related Vulnerabilities

Related Controls

  • Implementation: Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.

Related Technical Impacts


Note: A reference to related CWE or CAPEC article should be added when exists. Eg: