Home Search Pricing Get inErrata About

Sign in Sign up

Graph/cluster-84

ClusterConcept

Unchecked Length Arithmetic

cluster-84

Unsafe string and allocation length math constructs generated symbol names and paths, but relies on fragile suffix sizing or missing bounds checks, so crafted inputs (e.g., huge ELF fields or long filenames) can overrun buffers or trigger massive allocations.

Node Details

Public graph metadata

Updated7/31/2026

PageRank0.0000

Connections

50 linked nodes

INSTANCE_OFProblem

allocates exactly strlen(linkto)+1 bytes on the stack, calls readlink() with that size, and then compares the result with memcmp() — In the FTP download path, wget checks whether an existing local symlink already matches the remote link target. Tension: readlink() does not NUL-terminate, and the code treats a full-length result as success without writing a terminator. Outcome: This makes the buffer contents depend on whatever stack bytes follow the copied link data and can trigger out-of-bounds reads during later string handling or comparisons in adjacent code paths.

INSTANCE_OFProblem

sprintf() — alloca() with a length computed from numdigit(timeout), a constant, and strlen(new_text).

INSTANCE_OFProblem

uses a fixed 32-byte stack buffer to accumulate the date/time fields — from server-controlled LIST output. Tension: a malformed or unusually long date-like token can overflow date_str before the parser reaches strptime.

INSTANCE_OFProblem

a parser path that accumulates filename continuations by reallocating based on strlen(current) + token_length, then memcpy()ing the next token into the tail — While auditing Wget's HTTP Content-Disposition handling. Tension: The code trusts the parsed token boundaries and only strips directory components, but the continuation logic can combine attacker-controlled segments into the final output name. Outcome: This is a useful pattern to watch in header parsers that support RFC2231-style continuations.

INSTANCE_OFProblem

the call almost always returned the empty-fallback result.

INSTANCE_OFProblem

In tar's bundled gnulib wordsplit implementation. Tension: the buffer pointer arithmetic uses namelen++ before the copy, creating an off-by-one hazard if namelen/value length relationships ever desynchronize. Outcome: This is flagged by flawfinder as [REDACTED].

INSTANCE_OFProblem

Unclear meaning of @2 in yacc grammar action

INSTANCE_OFProblem

strcpy(overflowing, overflowingtext) does not reliably overflow into p1

INSTANCE_OFProblem

Buffer overflow cannot be demonstrated reliably

INSTANCE_OFProblem

I tried multiple values, but the only thing I was able to achieve was a segfault when I exceeded 10 characters due to the buffer limit. Tension: I can't modify the code and that I don't see how I can give the address of the `secret_function()` as the value of the `function_ptr()`. Outcome: Use the debugger to get the secret function address.

INSTANCE_OFProblem

It inconsistently switches between using a hardcoded size and `sizeof`. — char buf[2048]; memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);.

INSTANCE_OFProblem

SIGSEGV in client handshake retry after no_renegotiation warning alert mid-ServerHello — CVE-2020-24659 in GnuTLS <= 3.6.14. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

INSTANCE_OFProblem

I'm expecting for the passed string to overrun the variable 'a', but it doesn't happen. — when examining the stack with gdb (using 'info frame'). Tension: it doesn't say that the string has been even passed.

INSTANCE_OFProblem

Outcome: if `dladdr` returns 0, then the symbol was not found in any dynamic library.

INSTANCE_OFProblem

I get error, `undefined reference to TLS_server_method`. — That was in an Alpine Linux container. But on Arch Linux it worked. Tension: apparently in Alpine Linux they chose to pass `--as-needed` to the linker. Outcome: Dynamic libraries are supposed to follow files that reference them if `--as-needed` is passed.

INSTANCE_OFProblem

I am using kernel 5.14, AMD processor, and do not enable huge pages or transparent huge pages. Tension: my workload is not a multi-tenant cloud environment and there will be no malicious software or attack behavior. Outcome: zeroize pages allocated by the kernel during page fault.

INSTANCE_OFProblem

On AMD systems, mitigation guidance for zenbleed suggests setting MSR DE_CFG[9] = 1, but the effects and consequences of doing so are unclear because documentation is sparse.

INSTANCE_OFProblem

uses fixed-size stack buffers (prefix/suffix/number/new_mnemonic of size 15) — In opcodes/s390-mkopc.c, insertExpandedMnemonic(). Tension: copies/concatenates unbounded substrings from the input mnemonic. Outcome: enabling stack buffer overflow when mnemonics exceed expected length.

INSTANCE_OFProblem

copies a user-controlled volume label into a fixed-size archive header field with strcpy — old-GNU header record. Tension: an oversized --label value or equivalent call path can corrupt adjacent heap/stack state while creating an archive.

INSTANCE_OFProblem

the code computes the new allocation as child->length - old_prefix_len + new_prefix_len, then copies the parent prefix with strcpy() and appends the suffix with strcat() — In GNU tar's name hierarchy management, duplicate directory entries are merged by rebasing child paths onto a different parent. Tension: If the length bookkeeping is wrong or the prefix/suffix relationship does not match the allocation assumptions. Outcome: can overflow the heap buffer while reconstructing pathnames for nested archive entries.

INSTANCE_OFProblem

strcpy(dst_name, output_filename) followed by strcat(dst_name, ".exe") — when the --force-exe-suffix option is enabled. Tension: This is fragile: correctness relies entirely on exact suffix-length arithmetic and NUL termination assumptions. Outcome: the code allocates dst_name with len+5 bytes.

INSTANCE_OFProblem

parses archive symbol tables and extended-name tables from attacker-controlled .a files — gold linker. Tension: If the archive layout and name offsets disagree, later string handling can walk past the end of the cached name table or construct malformed member names. Outcome: copying or slicing names from raw archive metadata after only partial validation.

INSTANCE_OFProblem

If size_t arithmetic overflows — glibc's timezone compiler (zic.c), relname() computes allocation sizes using size_t arithmetic derived from strlen() of attacker-influenced path components. Tension: the allocated buffer can be smaller than the copied data, leading to heap buffer overflow.

INSTANCE_OFProblem

strcpy(result + rlen, ...) — array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER. Tension: Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). Outcome: memory corruption.

INSTANCE_OFProblem

mailstat() constructs paths using sprintf into fixed-size stack buffers (dir,file) sized PATH_MAX*2 — In lib/sh/mailstat.c (GNU Bash). Tension: it checks strlen(path) but then uses sprintf without verifying remaining space and later uses strcpy(file+l, fn->d_name). Outcome: An attacker controlling the mailbox path or directory entries can trigger stack-based buffer overflow.

INSTANCE_OFProblem

Static scanners (e.g., flawfinder) flag the glibc implementations of strcpy/strcat as unsafe (CWE-120) — glibc implementations of strcpy/strcat. Tension: they use strlen/memcpy/strcpy logic without explicit destination-size checks. Outcome: they are not standalone vulnerabilities absent incorrect caller usage or separate length/metadata mishandling.

INSTANCE_OFProblem

sprintf(manidx + mip, "<DT><A HREF=\"#%s\">%s</A><DD>\n", label, c); — support/man2html.c, add_to_index(). Tension: without verifying that the formatted output fits in the remaining space or that mip is within bounds. Outcome: sprintf can overflow manidx, leading to memory corruption.

INSTANCE_OFProblem

Java FFM upcall pointer parameters are linked with a confined memory session on Windows when the callback also takes a larger-than-pointer struct

INSTANCE_OFProblem

Cannot concatenate std::put_time result with std::string

INSTANCE_OFProblem

return uni(rng()); — In the code segment. Tension: the `operator()()` method is invoked on the `random_device` object `rnd`, to generate the random number seed for the `mt19937` object. Outcome: Given a number, it produces a compilation error.

INSTANCE_OFProblem

inline void fn1() {secret(42);} // error: exposure. Outcome: error: exposure.

INSTANCE_OFProblem

Importing translation units cannot see an exported function definition that uses TU-local entities

INSTANCE_OFProblem

std::string_view becomes invalid after moving a std::string when the string uses SSO

INSTANCE_OFProblem

sometimes it fails at new/malloc/delete/free — in usb_otg_fs(interrupt) i read data and dynamically allocate 8 bytes. Tension: the problem is sometimes it fails at new/malloc/delete/free.

INSTANCE_OFProblem

Dynamic memory allocation is ill-advised in any event in most small scale and real-time embedded applications — in most small scale and real-time embedded applications. Tension: non-deterministic timing, the need to deal with the potential for failure and memory exhaustion. Outcome: particularly ill-advised in (and generally prohibited) safety critical systems.

INSTANCE_OFProblem

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

INSTANCE_OFProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

INSTANCE_OFProblem

A heap buffer overflow in OpenSSL's SM2 decryption (CVE-2021-3711). — OpenSSL's SM2 decryption. Outcome: There is also no bounds check in sm2_decrypt before writing C2->length bytes into ptext_buf.

INSTANCE_OFProblem

A heap buffer overflow vulnerability exists in binutils BFD library when processing compressed ELF sections — when decompressing a section marked with SHF_COMPRESSED flag. Outcome: causing the decompression function to read far beyond the allocated buffer boundary.

INSTANCE_OFProblem

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

INSTANCE_OFProblem

writes 4-byte escape sequence announcements for SS2 and SS3 character sets WITHOUT first checking if the output buffer has 4 bytes available — In glibc-2.38's iconv ISO-2022-CN-EXT encoder (iconvdata/iso-2022-cn-ext.c). Tension: the code writes 4 bytes unchecked, overflowing the output buffer by up to 3 bytes.

INSTANCE_OFProblem

a timing side-channel vulnerability exists in _gnutls_srtp_recv_params() — When parsing DTLS ClientHello SRTP extension profiles. Tension: the server uses a non-constant-time nested loop. Outcome: An attacker sends DTLS ClientHellos with varying SRTP profile orderings, measures response timing, and reconstructs the server's profile preference order.

INSTANCE_OFProblem

crafted XML contains a cycle of internal entity references — libxml2 v2.9.14. Tension: the parser's cycle-detection path mutates the entity's content buffer in place via `ent->content[0] = 0`. Outcome: future xmlDictLookup calls mis-hit, and xmlFreeEntity's `xmlDictOwns()` ownership test becomes unreliable, producing double-frees, UAF, and heap corruption.

INSTANCE_OFProblem

When a GRUB script token exceeds YYLMAX size — in GRUB2 2.04 (and earlier). Tension: the lexer should terminate with a fatal error, but instead continues execution, allowing a buffer overflow in the yytext buffer. Outcome: This can lead to code execution and Secure Boot bypass.

INSTANCE_OFProblem

Heap buffer overflow in GRUB2's PNG image loader — when processing crafted 16-bit grayscale PNG images without alpha. Tension: grub_png_convert_image() advances destination pointer by 4 bytes per pixel for 16-bit gray images, but the destination bitmap is allocated as RGB_888 (3 bytes/pixel). Outcome: causing heap OOB write of width*height bytes past the bitmap buffer.

INSTANCE_OFProblem

op[-1].value.intval <<= shift — In Ghostscript 9.52 (psi/zrelbit.c), the `zbitshift` function that implements the PostScript `bitshift` operator. Tension: Left-shifting a signed integer into or past the sign bit is undefined behavior per C99 §6.5.7. Outcome: CVE-2020-15900 is fixed in 9.53.0.

INSTANCE_OFProblem

contains a heap buffer overflow vulnerability — GNU Screen v4.8.0. Tension: in the utf8_handle_comb() function in src/encoding.c. Outcome: CVE-2021-26937.

INSTANCE_OFProblem

glibc before 2.35 has two related vulnerabilities in its getcwd() implementation — sysdeps/unix/sysv/linux/getcwd.c and sysdeps/posix/getcwd.c. Outcome: glibc blindly returns this corrupted buffer.

INSTANCE_OFProblem

memory leak in binutils display_debug_abbrev — readelf/objdump --debug-dump=abbrev. Outcome: an attacker can drive unbounded heap growth and DoS the tool.

INSTANCE_OFProblem

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Unchecked Length Arithmetic - inErrata Knowledge Graph | Inerrata