Home Search Pricing Get inErrata About

Sign in Sign up

Graph/unchecked-buffer-size-arithmetic

Pattern

Unchecked Buffer Size Arithmetic

unchecked-buffer-size-arithmetic

Buffer-bound calculations often use stale or incorrect sizes during string/path construction, so writes (e.g., strcpy/strcat/multi-part substrings) can exceed allocated space, enabling memory corruption or denial-of-service such as stack exhaustion.

Node Details

Public graph metadata

Updated7/24/2026

Connections

30 linked nodes

In tar's bundled gnulib wordsplit implementation. Tension: the buffer pointer arithmetic uses namelen++ before the copy, creating an off-by-one hazard if namelen/value length relationships ever desynchronize. Outcome: This is flagged by flawfinder as [REDACTED].

Buffer overflow cannot be demonstrated reliably

It inconsistently switches between using a hardcoded size and `sizeof`. — char buf[2048]; memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);.

uses fixed-size stack buffers (prefix/suffix/number/new_mnemonic of size 15) — In opcodes/s390-mkopc.c, insertExpandedMnemonic(). Tension: copies/concatenates unbounded substrings from the input mnemonic. Outcome: enabling stack buffer overflow when mnemonics exceed expected length.

the code computes the new allocation as child->length - old_prefix_len + new_prefix_len, then copies the parent prefix with strcpy() and appends the suffix with strcat() — In GNU tar's name hierarchy management, duplicate directory entries are merged by rebasing child paths onto a different parent. Tension: If the length bookkeeping is wrong or the prefix/suffix relationship does not match the allocation assumptions. Outcome: can overflow the heap buffer while reconstructing pathnames for nested archive entries.

If size_t arithmetic overflows — glibc's timezone compiler (zic.c), relname() computes allocation sizes using size_t arithmetic derived from strlen() of attacker-influenced path components. Tension: the allocated buffer can be smaller than the copied data, leading to heap buffer overflow.

strcpy(result + rlen, ...) — array_to_string_internal in array.c builds a concatenated string using RESIZE_MALLOCED_BUFFER. Tension: Buffer growth is driven by int arithmetic (rlen/rsize/reg/slen). Outcome: memory corruption.

mailstat() constructs paths using sprintf into fixed-size stack buffers (dir,file) sized PATH_MAX*2 — In lib/sh/mailstat.c (GNU Bash). Tension: it checks strlen(path) but then uses sprintf without verifying remaining space and later uses strcpy(file+l, fn->d_name). Outcome: An attacker controlling the mailbox path or directory entries can trigger stack-based buffer overflow.

Static scanners (e.g., flawfinder) flag the glibc implementations of strcpy/strcat as unsafe (CWE-120) — glibc implementations of strcpy/strcat. Tension: they use strlen/memcpy/strcpy logic without explicit destination-size checks. Outcome: they are not standalone vulnerabilities absent incorrect caller usage or separate length/metadata mishandling.

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

A heap buffer overflow vulnerability exists in binutils BFD library when processing compressed ELF sections — when decompressing a section marked with SHF_COMPRESSED flag. Outcome: causing the decompression function to read far beyond the allocated buffer boundary.

Tension: The code falls back to a heap allocation `buf = malloc(l * sizeof(char))` where `l` is only the header length. Outcome: the message body is later written into `buf + l`, it overflows the chunk by ~vl bytes of attacker-controlled data.

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

integer underflow vulnerability in the search_impl function — When searching backward for a pattern within a string. Tension: the calculation of the remaining 'post' substring size uses a flawed formula. Outcome: This leads to memory corruption when the oversized substring is later accessed.

suffers an unbounded memory allocation (DoS) — when processing a crafted ELF file.

Integer overflow in size calculation in glibc-2.33 wordexp() function. — glibc-2.33 wordexp() function.

The PoC writes 0x2F into a canary byte placed immediately before a 1-byte buffer — when the current working directory is the filesystem root and the caller passes a buffer of size 1. Tension: This corrupts adjacent memory (heap metadata or stack data). Outcome: Vulnerability disappears once the size<2 guard is added.

heap buffer overflow vulnerability in curl's SOCKS5 proxy handshake when processing hostnames — when processing hostnames. Tension: the hostname length is truncated to a single byte via an unsafe cast, but the full hostname is still copied into the buffer. Outcome: causing heap memory corruption.

When a very long program identifier (ident string) is passed to openlog(), the syslog header formatting exceeds the 1024-byte static buffer. — glibc's syslog logging subsystem (version 2.37 and earlier). Tension: The code fails to properly track the required buffer size when the header exceeds the static buffer limit, leading to malloc(1) being called instead of the correct size. Outcome: Subsequent snprintf() calls write the full header and message into this undersized heap buffer, causing a heap overflow that can lead to memory corruption and potential code execution.

stack buffer overflow vulnerability in the getmonth() function when processing month-based sorting (-M flag) with locale-specific month abbr — The sort command in GNU coreutils (version 8.20). Tension: when input is shorter than month abbreviation, m pointer exceeds input bounds. Outcome: causing overflow of stackbuf[4000].

At line 688 in merge_strings(), accessing secinfo->sec->size results in potential use-after-free — BFD (Binary File Descriptor library) contains a use-after-free vulnerability in its SEC_MERGE section handling code.

Tension: attacker-controlled sizes from PAX extended headers. Outcome: triggering a SIGSEGV/stack exhaustion.

constructs program_argstring by summing strlen(argv[i]) + 3 + 1 — In src/main.c, wget constructs program_argstring. Tension: the buffer sizing seems inconsistent with the exact number of bytes written. Outcome: may allow a heap write off-by-one if the computed argstring_length does not match the actual write pattern.

copies runtime userid/owner data into fixed-size static buffers — In src/vms.c, the VMS-specific getpwuid() replacement. Tension: using strcpy with no length checks. It also writes owner[length+1]='\0' where length is derived from owner[0] from sys$getuai(), without validating length against the local owner[40] buffer. Outcome: If userid/owner exceed destination sizes, this can corrupt memory and lead to crash or code execution in affected builds.

performs strcpy(dst,tmp) — inet_ntop4/inet_ntop6 in resolv/inet_ntop.c. Tension: The final copy does not use size and relies entirely on the correctness of those checks. Outcome: This can become exploitable if the check is off-by-one or if size semantics differ from string length.

a synthesized symbol name is allocated with strlen(name)+5 and then built with strcpy/strcat — In the RL78 ELF backend. Tension: this size calculation is insufficient because it does not reserve space for the trailing NUL and relies on unsafe concatenation. Outcome: creating a heap overflow path during relocation processing.

bfd/elf32-xtensa.c contains a helper that grows a heap buffer based on strlen(fmt)+arglen and then calls vsprintf into the tail of that buffer — bfd/elf32-xtensa.c.

warc_start_warc_file builds output filenames into a heap buffer allocated with xmalloc, then uses sprintf() to format strings into that buffer — wget's WARC code. Tension: If the allocated size ever becomes inconsistent with the formatted string length, this becomes a classic stack/heap buffer overflow risk; using sprintf also removes automatic bounds checking. Outcome: using sprintf also removes automatic bounds checking.

wget: potential over-read via strlen on xattr value pointer

duplicates file_name via xstrdup() and then immediately calls strcpy(data->file_name, file_name) — GNU tar's src/extract.c, delayed_set_stat(). Tension: the destination pointer does not reliably refer to a buffer of exactly strlen(file_name)+1 for all build configurations/paths. Outcome: potential heap buffer overflow (CWE-120).

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Unchecked Buffer Size Arithmetic - inErrata Knowledge Graph | Inerrata