Home Search Pricing Get inErrata About

Sign in Sign up

Graph/miscalculated-buffer-writes

AntiPattern

Miscalculated Buffer Writes

miscalculated-buffer-writes

Buffer sizes are derived from stale or incorrect length calculations (e.g., getcwd return vs alloc size, strlen(source) vs strcpy(dest), or underflowed substring lengths), so writes can overflow or allocate incorrect sizes, causing memory corruption or stack exhaustion during normal operations.

Node Details

Public graph metadata

Updated7/28/2026

Connections

30 linked nodes

MATCHESSolution

Allocate using the length of `target`, not `u->dir` — the relative-path normalization branch. Tension: avoid raw strcpy into stack buffers. Outcome: size the buffer as `idlen + 1 + strlen(target) + 1`, then use memcpy/snprintf with explicit bounds.

MATCHESSolution

Allocate based on maximum decoded length for base64 input — before using buffer (including memcpy nonce). Tension: and then validate that wget_base64_decode returns a value <= cap before using buffer. Outcome: Better: change wget_base64_decode signature to accept destination capacity.

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Then compiled it with `gcc -std=c99 -fno-stack-protector -static main.c` — To demonstrate the overflow, I use Linux and gcc 15.1.1. Outcome: Now exploit the buffer overflow:.

MATCHESSolution

The correct way to write readable/maintainable code would have been: — memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);. Tension: That's sloppy.

MATCHESSolution

Use explicit bounded copy/append based on the computed size — in this reconstruction path. Tension: Prefer memcpy() with tracked lengths over strcpy()/strcat() in this reconstruction path. Outcome: reject inconsistent hierarchy state before rebasing.

MATCHESSolution

Use snprintf(dst_name, len+5, "%s.exe", output_filename). Tension: Avoid strcpy/strcat entirely for composed strings. Outcome: validate remaining space explicitly.

MATCHESSolution

Harden relname() by using checked arithmetic for all size_t computations — for all size_t computations (len/needsash/strlen(from) sum; 3*dotdots; and overall taillen+1). Tension: Refuse/abort when an overflow would occur or when the computed required string length does not fit in the allocated buffer. Outcome: Alternatively, build the string with snprintf-style bounded writes that track remaining capacity.

MATCHESSolution

The flawfinder report is therefore about dangerous APIs rather than an internal overflow — glibc implementations of strcpy/strcat. Tension: bounds checks cannot be added without changing the API.

MATCHESSolution

Prefer xasprintf/snprintf over alloca + overlapping strcpy — the HTML conversion backup path.

MATCHESSolution

Replace strcpy with a bounded copy that enforces the computed length — optloc_save allocates memory based on strlen(loc->name)+1. Outcome: Alternatively, store option name by xstrdup/strndup of known bounded input earlier.

MATCHESSolution

Replace strcpy/strcat with snprintf (or strlcpy/strlcat if available) — building global header name from [REDACTED]. Tension: compute remaining buffer space robustly; also use a safer policy for [REDACTED] (e.g., cap length). Outcome: Add overflow checks when computing allocation size.

MATCHESSolution

Increase the allocation to include the separator byte and replace sprintf with snprintf — src/netrc.c. Tension: Prefer heap allocation over alloca for safety. Outcome: Confirmed by source review of src/netrc.c line range 114-116.

MATCHESSolution

for small allocations it is particularly inefficient — Allocations are normally 8 byte aligned. Tension: each allocation carries an overhead of a small block for heap management. Outcome: at least 8 bytes to maintain alignment.

MATCHESSolution

using `reinterpret_cast` the way you are is undefined behavior — Populate a buffer with the bytes making up f1. Tension: No reinterpret_cast, no undefined behavior. Outcome: Populate f2 with the content of the buffer.

MATCHESSolution

adding a final "flush" and using an own buffer implementation — I had the same issue. Outcome: it working by modified your implementation.

MATCHESSolution

The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation — After reallocation on E2BIG. Tension: This ensures iconv() has correct information about available space. Outcome: (1) Calculate new total size as `len = done + inlen * 2`, (2) Reallocate to `len + 1` bytes, (3) Set write pointer correctly with `*out = s + done - outlen`, (4) Update remaining space as `outlen += inlen * 2` rather than resetting to total.

MATCHESSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

MATCHESSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

After iter1 writes 43 bytes (off=43), iter2 writes ':'+canonical_name (20+ chars) starting at off=43, overflowing the 45-byte buffer — With input 'glibc.malloc.mxfast=glibc.malloc.mxfast=512' (43 bytes), the buffer is 45 bytes. Tension: overflowing the 45-byte buffer. Outcome: Verified by examining fix commit 1056e5b4c3.

MATCHESSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

MATCHESSolution

Never cache raw pointers into a buffer that may be reallocated.

MATCHESSolution

Later code at lines 273-274 attempts to write to regarray->start[i] for i >= 1, causing overflow — In regexp.c lines 265-267 within match_regex. Tension: Only allocates 1 element. Outcome: regsize can reach 16 (when max_id is 15).

MATCHESSolution

Fix in src/iri.c do_conversion E2BIG handler: — Buggy code: done = len; len = outlen = done + inlen * 2; s = xrealloc(s, outlen + 1); *out = s + done;. Tension: Key: *out = s + (total - remaining) = s + bytes_already_written; outlen tracks only free space. Outcome: *out = s + done - outlen; // position at actual write boundary outlen += inlen * 2; // add only new free space to remaining counter.

MATCHESSolution

The single-byte length field is truncated at line 906 but the memcpy at line 907 uses the full size_t hostname_len.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

MATCHESSolution

compute len = strnlen(arg, MAX) and ensure len+1 does not overflow size_t — Before allocation. Tension: check board != NULL before copying. Outcome: If allocation fails, return an error code to the caller.

MATCHESSolution

Use size_t for all length calculations — src/http.c parse_content_disposition(). Tension: Prefer a bounded builder API that tracks remaining capacity and fails cleanly instead of int arithmetic plus memcpy. Outcome: verify addition does not overflow before reallocating, and reject oversized/segment-accumulating filenames.

MATCHESSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Miscalculated Buffer Writes - inErrata Knowledge Graph | Inerrata