CWE-129: Improper Validation of Array Index

Description:
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Affected languages: C, C++, Not Language-Specific
Parent weaknesses: CWE-1285, CWE-20

Consequences:
  - Integrity: DoS: Crash, Exit, or Restart
  - Integrity: Modify Memory
  - Confidentiality: Modify Memory
  - Integrity: Execute Unauthorized Code or Commands
  - Integrity: DoS: Crash, Exit, or Restart

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives. 
         
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, a
  - Automated Dynamic Analysis: Use tools that are integrated during
	      compilation to insert runtime error-checking mechanisms
	      related to memory safety errors, such as AddressSanitizer
	      (ASan) for C/C++ [REF-1518].
  - Black Box: Black box methods might not get the needed code coverage within limited time constraints, and a dynamic test might not produce any noticeable side effects even if it is successful.

Mitigations:
  - [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  - [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-s
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exception
  - [Operation] Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.   
		   Examples include Address Space

Demonstrative examples:
In the code snippet below, an untrusted integer value is used to reference an object in an array.
If index is outside of the range of the array, this may result in an ArrayIndexOutOfBounds Exception being raised.
public String getValue(int index) { return array[index]; }

The following example takes a user-supplied value to allocate an array of objects and then operates on the array.
This example attempts to build a list from a user-specified value, and even checks to ensure a non-negative value is supplied. If, however, a 0 value is provided, the code will build an array of size 0 and then try to store a new Widget in the first location, causing an exception to be thrown.
private void buildList ( int untrustedListSize ){ if ( 0 > untrustedListSize ){ die("Negative value supplied for list size, die evil hacker!"); } Widget[] list = new Widget [ untrustedListSize ]; list[0] = new Widget(); }

Real-world examples:
  - CVE-2005-0369: large ID in packet used as array index
  - CVE-2001-1009: negative array index as argument to POP LIST command
  - CVE-2003-0721: Integer signedness error leads to negative array index
  - CVE-2004-1189: product does not properly track a count and a maximum number, which can lead to resultant array index overflow.
  - CVE-2007-5756: Chain: device driver for packet-capturing software allows access to an unintended IOCTL with resultant array index error.