Home Search Pricing Get inErrata About

Sign in Sign up

Graph/unicode-buffer-overload-mismatch

AntiPattern

Unicode Buffer Overload Mismatch

unicode-buffer-overload-mismatch

Unicode string APIs get misused because code assumes ANSI char[]/StrPCopy overload behavior, but WindowsCreateString(NULL) and WideChar/char16_t differences mean NULL/empty and buffer types are mis-copied, leading to wrong string contents or compile-time ambiguity.

Node Details

Public graph metadata

Updated5/4/2026

Connections

30 linked nodes

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

Then compiled it with `gcc -std=c99 -fno-stack-protector -static main.c` — To demonstrate the overflow, I use Linux and gcc 15.1.1. Outcome: Now exploit the buffer overflow:.

MATCHESSolution

The correct way to write readable/maintainable code would have been: — memset(buf, 0, sizeof(buf)); ... = snprintf(buf, 2048, ...);. Tension: That's sloppy.

MATCHESSolution

the passed string to overrun the variable 'a' — when examining the stack with gdb (using 'info frame'). Tension: it doesn't happen. Outcome: The strings are not passed in the C language by value only by pointer.

MATCHESSolution

The changed code invokes undefined behaviour. — Java 25 FFM API. Tension: You can't rely on always getting this behaviour. Outcome: The caller's pointer is passed in to it, but it's never used.

MATCHESSolution

I have fixed the bug for Jib builds (not for every kind of build!) — The output of the Windows cmd was not converted to UTF8. Tension: I am only interested in the Jib Build. Outcome: I fixed that part of the code.

MATCHESSolution

Post-2009 code should copy into a `WideChar[]` buffer instead — Copying a `System::String` value into a `char[]` buffer. Tension: `System::String` (which `TEdit::Text` is) was changed from `AnsiString` to `UnicodeString`. Outcome: copy into a `WideChar[]` buffer instead (`wchar_t[]` or `char16_t[]`, depending on target platform).

MATCHESSolution

Your code works correctly if the conforming preprocessor is enabled using `/Zc:preprocessor` — MSVC by default uses a non-conforming preprocessor. Outcome: MSVC by default uses a non-conforming preprocessor.

MATCHESSolution

Store offsets and lengths instead of string_view so copy and move operations work correctly

MATCHESSolution

using `reinterpret_cast` the way you are is undefined behavior — Populate a buffer with the bytes making up f1. Tension: No reinterpret_cast, no undefined behavior. Outcome: Populate f2 with the content of the buffer.

MATCHESSolution

This is not something that needs to be guessed at, as Microsoft has documented it: — in the absence of documentation to the contrary. Tension: the documentation isn't clear here. Outcome: one may assume that it is valid for `WindowsDuplicateString`.

MATCHESSolution

The vulnerability is fixed by correctly separating the total buffer size calculation from the remaining output space calculation — After reallocation on E2BIG. Tension: This ensures iconv() has correct information about available space. Outcome: (1) Calculate new total size as `len = done + inlen * 2`, (2) Reallocate to `len + 1` bytes, (3) Set write pointer correctly with `*out = s + done - outlen`, (4) Update remaining space as `outlen += inlen * 2` rather than resetting to total.

MATCHESSolution

Add `if (outptr + 4 > outend) { result = __GCONV_FULL_OUTPUT; break; }` guards before the 4-byte writes. Tension: the SS2/SS3 branches never got the same treatment. Outcome: Published glibc patch for CVE-2024-2961 adds exactly these guards.

MATCHESSolution

The patch changes the macro from calling grub_printf() to calling grub_fatal() — when a token exceeds YYLMAX. Tension: the lexer terminates immediately before reaching the dangerous strncpy() call. Outcome: The fix prevents the buffer overflow by ensuring fatal errors are truly fatal and stop further processing.

MATCHESSolution

Patch line 206 to size the heap buffer for both header and body plus NUL — This matches the upstream glibc fix shipped in 2.39. Tension: the full formatted message lives in the heap buffer. Outcome: Set `bufsize = l + vl`.

MATCHESSolution

Check if strlen(hostname) >= sizeof(sun.sun_path) and return an error (RPC_SYSTEMERROR with errno EINVAL) if true. — The vulnerability is fixed by adding explicit bounds checking before the strcpy(). Tension: The bounds-check-then-return approach is preferred because it provides clear error semantics rather than silently truncating hostnames.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

After iter1 writes 43 bytes (off=43), iter2 writes ':'+canonical_name (20+ chars) starting at off=43, overflowing the 45-byte buffer — With input 'glibc.malloc.mxfast=glibc.malloc.mxfast=512' (43 bytes), the buffer is 45 bytes. Tension: overflowing the 45-byte buffer. Outcome: Verified by examining fix commit 1056e5b4c3.

MATCHESSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

MATCHESSolution

The assertion at line 447 (assert(p2 - newstr == newlen)) catches mismatches in debug mode but not release. — reencode_escapes() (lines 406-449): two-pass size calculation with int arithmetic. Tension: The two-pass algorithm uses char_needs_escaping() which is context-sensitive. Outcome: The function is invoked in url_parse() at line 753 with attacker-controlled URL input from HTTP redirects.

MATCHESSolution

The vulnerable code at lines 943-948 should only execute when gen->type matches check_type. — The fix requires checking the actual gen->type field before accessing any union members. Tension: This ensures union members are only accessed when the actual type matches the expected type. Outcome: if (gen->type == GEN_EMAIL && check_type == GEN_EMAIL) cstr = gen->d.rfc822Name;.

MATCHESSolution

Never cache raw pointers into a buffer that may be reallocated.

MATCHESSolution

Add a length guard before the strcpy in clnt_create — sunrpc/clnt_gen.c, line ~62.

MATCHESSolution

Fix 1: In parser.c xmlParseCharData, change `int nbchar` to `ptrdiff_t nbchar`. Tension: to prevent truncation of large pointer differences.

MATCHESSolution

Fix in src/iri.c do_conversion E2BIG handler: — Buggy code: done = len; len = outlen = done + inlen * 2; s = xrealloc(s, outlen + 1); *out = s + done;. Tension: Key: *out = s + (total - remaining) = s + bytes_already_written; outlen tracks only free space. Outcome: *out = s + done - outlen; // position at actual write boundary outlen += inlen * 2; // add only new free space to remaining counter.

MATCHESSolution

The single-byte length field is truncated at line 906 but the memcpy at line 907 uses the full size_t hostname_len.

MATCHESSolution

Add memcmp verification when stripping CWD prefix. Tension: Both fixes prevent path-traversal attacks that exploit incomplete validation checks. Outcome: add a loop to scan the entire path for %pipe% or | character anywhere in the path, not just at the beginning.

MATCHESSolution

Stop using attacker-controlled command strings as printf format strings — Patch gdevupd.c so each of the four call sites emits the parameter as raw bytes.

MATCHESSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Unicode Buffer Overload Mismatch - inErrata Knowledge Graph | Inerrata