CWE-193: Off-by-one Error

Description:
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected languages: C, Not Language-Specific
Parent weaknesses: CWE-682, CWE-682

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Modify Memory
  - Confidentiality: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strnca

Demonstrative examples:
The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.
However, this code contains an off-by-one calculation error (CWE-193). It allocates exactly enough space to contain the specified number of widgets, but it does not include the space for the NULL pointer. As a result, the allocated buffer is smaller than it is supposed to be (CWE-131). So if the user ever requests MAX_NUM_WIDGETS, there is an out-of-bounds write (CWE-787) when the NULL is assigned. Depending on the envir

In this example, the code does not account for the terminating null character, and it writes one byte beyond the end of the buffer.
The first call to strncat() appends up to 20 characters plus a terminating null character to fullname[]. There is plenty of allocated space for this, and there is no weakness associated with this first call. However, the second call to strncat() potentially appends another 20 characters. The code does not account for the terminating null character that is automatically added by strncat(). This terminating null character would be written one byte beyond the end of the fullname[] buffer. Therefore an off-by-one error exists with the second strncat() call, as the third argument should be 19.
char firstname[20]; char lastname[20]; char fullname[40]; fullname[0] = 

Real-world examples:
  - CVE-2003-0252: Off-by-one error allows remote attackers to cause a denial of service and possibly execute arbitrary code via requests that do not contain newlines.
  - CVE-2001-1391: Off-by-one vulnerability in driver allows users to modify kernel memory.
  - CVE-2002-0083: Off-by-one error allows local users or remote malicious servers to gain privileges.
  - CVE-2002-0653: Off-by-one buffer overflow in function usd by server allows local users to execute arbitrary code as the server user via .htaccess files with long entries.
  - CVE-2002-0844: Off-by-one buffer overflow in version control system allows local users to execute arbitrary code.