Home Search Pricing Get inErrata About

Sign in Sign up

Graph/buffer-size-miscalculation

Pattern

Miscalculated Buffer Sizes

buffer-size-miscalculation

Buffer-writing code trusts derived length values (from syscall return, strlen-based estimates, or substring formulas) without fully bounding against allocated capacity, so strcpy/concat-style writes overflow or underflow and can cause crashes or memory corruption.

Node Details

Public graph metadata

Updated6/24/2026

Connections

30 linked nodes

Buffer overflow cannot be demonstrated reliably

It inconsistently switches between using a hardcoded size and `sizeof`. — char buf[2048]; memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);.

uses fixed-size stack buffers (prefix/suffix/number/new_mnemonic of size 15) — In opcodes/s390-mkopc.c, insertExpandedMnemonic(). Tension: copies/concatenates unbounded substrings from the input mnemonic. Outcome: enabling stack buffer overflow when mnemonics exceed expected length.

If size_t arithmetic overflows — glibc's timezone compiler (zic.c), relname() computes allocation sizes using size_t arithmetic derived from strlen() of attacker-influenced path components. Tension: the allocated buffer can be smaller than the copied data, leading to heap buffer overflow.

strcpy(result + rlen, ...) — array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER. Tension: Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). Outcome: memory corruption.

Static scanners (e.g., flawfinder) flag the glibc implementations of strcpy/strcat as unsafe (CWE-120) — glibc implementations of strcpy/strcat. Tension: they use strlen/memcpy/strcpy logic without explicit destination-size checks. Outcome: they are not standalone vulnerabilities absent incorrect caller usage or separate length/metadata mishandling.

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

A heap buffer overflow vulnerability exists in binutils BFD library when processing compressed ELF sections — when decompressing a section marked with SHF_COMPRESSED flag. Outcome: causing the decompression function to read far beyond the allocated buffer boundary.

Heap buffer overflow in GRUB2's PNG image loader — when processing crafted 16-bit grayscale PNG images without alpha. Tension: grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images, but the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Outcome: causing heap OOB write of width*height bytes past the bitmap buffer.

glibc before 2.35 has two related vulnerabilities in its getcwd() implementation — sysdeps/unix/sysv/linux/getcwd.c and sysdeps/posix/getcwd.c. Outcome: glibc blindly returns this corrupted buffer.

memory leak in binutils display_debug_abbrev — readelf/objdump --debug-dump=abbrev. Outcome: an attacker can drive unbounded heap growth and DoS the tool.

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

integer underflow vulnerability in the search_impl function — When searching backward for a pattern within a string. Tension: the calculation of the remaining 'post' substring size uses a flawed formula. Outcome: This leads to memory corruption when the oversized substring is later accessed.

suffers an unbounded memory allocation (DoS) — when processing a crafted ELF file.

Integer overflow in size calculation in glibc-2.33 wordexp() function. — glibc-2.33 wordexp() function.

The PoC writes 0x2F into a canary byte placed immediately before a 1-byte buffer — when the current working directory is the filesystem root and the caller passes a buffer of size 1. Tension: This corrupts adjacent memory (heap metadata or stack data). Outcome: Vulnerability disappears once the size<2 guard is added.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

When a very long program identifier (ident string) is passed to openlog(), the syslog header formatting exceeds the 1024-byte static buffer. — glibc's syslog logging subsystem (version 2.37 and earlier). Tension: The code fails to properly track the required buffer size when the header exceeds the static buffer limit, leading to malloc(1) being called instead of the correct size. Outcome: Subsequent snprintf() calls write the full header and message into this undersized heap buffer, causing a heap overflow that can lead to memory corruption and potential code execution.

stack buffer overflow vulnerability in the getmonth() function when processing month-based sorting (-M flag) with locale-specific month abbr — The sort command in GNU coreutils (version 8.20). Tension: when input is shorter than month abbreviation, m pointer exceeds input bounds. Outcome: causing overflow of stackbuf[4000].

At line 688 in merge_strings(), accessing secinfo->sec->size results in potential use-after-free — BFD (Binary File Descriptor library) contains a use-after-free vulnerability in its SEC_MERGE section handling code.

Tension: attacker-controlled sizes from PAX extended headers. Outcome: triggering a SIGSEGV/stack exhaustion.

constructs program_argstring by summing strlen(argv[i]) + 3 + 1 — In src/main.c, wget constructs program_argstring. Tension: the buffer sizing seems inconsistent with the exact number of bytes written. Outcome: may allow a heap write off-by-one if the computed argstring_length does not match the actual write pattern.

copies runtime userid/owner data into fixed-size static buffers — In src/vms.c, the VMS-specific getpwuid() replacement. Tension: using strcpy with no length checks. It also writes owner[length+1]='\0' where length is derived from owner[0] from sys$getuai(), without validating length against the local owner[40] buffer. Outcome: If userid/owner exceed destination sizes, this can corrupt memory and lead to crash or code execution in affected builds.

performs strcpy(dst,tmp) — inet_ntop4/inet_ntop6 in resolv/inet_ntop.c. Tension: The final copy does not use size and relies entirely on the correctness of those checks. Outcome: This can become exploitable if the check is off-by-one or if size semantics differ from string length.

a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat — In the RL78 ELF backend. Tension: this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation. Outcome: creating a heap overflow path during relocation processing.

bfd/elf32-xtensa.c contains a helper that grows a heap buffer based on strlen(fmt)+arglen and then calls vsprintf into the tail of that buffer — bfd/elf32-xtensa.c.

warc_start_warc_file builds output filenames into a heap buffer allocated with xmalloc, then uses sprintf() to format strings into that buffer — wget's WARC code. Tension: If the allocated size ever becomes inconsistent with the formatted string length, this becomes a classic stack/heap buffer overflow risk; using sprintf also removes automatic bounds checking. Outcome: using sprintf also removes automatic bounds checking.

wget: potential over-read via strlen on xattr value pointer

duplicates file_name via xstrdup() and then immediately calls strcpy(data->file_name, file_name) — GNU tar's src/extract.c, delayed_set_stat(). Tension: the destination pointer does not reliably refer to a buffer of exactly strlen(file_name)+1 for all build configurations/paths. Outcome: potential heap buffer overflow (CWE-120).

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata