CWE-124: Buffer Underwrite ('Buffer Underflow')

Description:
The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Affected languages: Memory-Unsafe, C, C++
Parent weaknesses: CWE-786, CWE-787

Consequences:
  - Integrity: Modify Memory
  - Integrity: Execute Unauthorized Code or Commands
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Mitigations:
  - [Requirements] Choose a language that is not susceptible to these issues.
  - [Implementation] All calculated values that are used as index or for pointer arithmetic should be validated to ensure that they are within an expected range.

Demonstrative examples:
In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.
However, this function can cause a buffer underwrite if the input character string contains all whitespace. On some systems the while statement will move backwards past the beginning of a character string and will call the isspace() function on an address outside of the bounds of the local buffer.
char* trimTrailingWhitespace(char *strMessage, int length) { 
                         char *retMessage; char *message = malloc(sizeof(char)*(length+1)); 
                     

The following is an example of code that may result in a buffer underwrite. This code is attempting to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by using the function strstr(), which returns a pointer to the found substring in destBuf.  Using pointer arithmetic, the starting index of the substring is found.
In the case where the substring is not found in destBuf, strstr() will return NULL, causing the pointer arithmetic to be undefined, potentially setting the value of idx to a negative number.  If idx is negative, this will result in a buffer underwrite of destBuf.
int main() {
                      ... 
                     char *result = strstr(destBuf, "Replace Me"); 
                     int idx = result - destBuf; 
                    

Real-world examples:
  - CVE-2021-24018: buffer underwrite in firmware verification routine allows code execution via a crafted firmware image
  - CVE-2002-2227: Unchecked length of SSLv2 challenge value leads to buffer underflow.
  - CVE-2007-4580: Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
  - CVE-2007-1584: Buffer underflow from an all-whitespace string, which causes a counter to be decremented before the buffer while looking for a non-whitespace character.
  - CVE-2007-0886: Buffer underflow resultant from encoded data that triggers an integer overflow.