CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Description:
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected languages: Memory-Unsafe, C, C++, Assembly
Parent weaknesses: CWE-787, CWE-119, CWE-787, CWE-787, CWE-20

Consequences:
  - Integrity: Modify Memory
  - Availability: Modify Memory

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives. 
         
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, a
  - Manual Analysis: Manual analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. This becomes difficult for weaknesses that must be considered f
  - Automated Dynamic Analysis: Use tools that are integrated during
	      compilation to insert runtime error-checking mechanisms
	      related to memory safety errors, such as AddressSanitizer
	      (ASan) for C/C++ [REF-1518].

Mitigations:
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. Thes
  - [Operation] Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detectio
  - [Implementation] Consider adhering to the following rules when allocating and managing an application's memory: 
                      
                         Double check that your buffer is as large as you specify. 
                         When using functions that accept a number of bytes to copy, such as strn

Demonstrative examples:
The following code asks the user to enter their last name and then attempts to store the value entered in the last_name array.
The problem with the code above is that it does not restrict or limit the size of the name entered by the user. If the user enters "Very_very_long_last_name" which is 24 characters long, then a buffer overflow will occur since the array can only hold 20 characters total.
char last_name[20]; printf ("Enter your last name: "); scanf ("%s", last_name);

The following code attempts to create a local copy of a buffer to perform some manipulations to the data.
However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.
void manipulate_string(char * string){ char buf[24]; strcpy(buf, string); ... }

Real-world examples:
  - CVE-2000-1094: buffer overflow using command with long argument
  - CVE-1999-0046: buffer overflow in local program using long environment variable
  - CVE-2002-1337: buffer overflow in comment characters, when product increments a counter for a ">" but does not decrement for "<"
  - CVE-2003-0595: By replacing a valid cookie value with an extremely long string of characters, an attacker may overflow the application's buffers.
  - CVE-2001-0191: By replacing a valid cookie value with an extremely long string of characters, an attacker may overflow the application's buffers.