CWE-805: Buffer Access with Incorrect Length Value

Description:
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

Extended Description:
When the length value exceeds the size of the destination, a buffer overflow could occur.

Affected languages: Memory-Unsafe, C, C++, Assembly
Parent weaknesses: CWE-119, CWE-119, CWE-119

Consequences:
  - Integrity: Read Memory
  - Availability: Modify Memory

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives. 
         
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, an
  - Manual Analysis: Manual analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. This becomes difficult for weaknesses that must be considered f
  - Automated Dynamic Analysis: Use tools that are integrated during
	      compilation to insert runtime error-checking mechanisms
	      related to memory safety errors, such as AddressSanitizer
	      (ASan) for C/C++ [REF-1518].

Mitigations:
  - [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. 
                   Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. Thes
  - [Operation] Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detectio
  - [Implementation] Consider adhering to the following rules when allocating and managing an application's memory: 
                      
                         Double check that the buffer is as large as specified. 
                         When using functions that accept a number of bytes to copy, such as strncpy

Demonstrative examples:
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
This function allocates a buffer of 64 bytes to store the hostname under the assumption that the maximum length value of hostname is 64 bytes, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.
void host_lookup(char *user_supplied_addr){ 
                         struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); 
                            
                            /*routine that ensures user_supplied_addr i

In the following example, it is possible to request that memcpy move a much larger segment of memory than assumed:
If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely available to the destination buffer (CWE-787, CWE-788).
int returnChunkSize(void *) { 
                         
                            
                            /* if chunk info is valid, return the size of usable memory, 
                            
                            
                        

Real-world examples:
  - CVE-2011-1959: Chain: large length value causes buffer over-read (CWE-126)
  - CVE-2011-1848: Use of packet length field to make a calculation, then copy into a fixed-size buffer
  - CVE-2011-0105: Chain: retrieval of length value from an uninitialized memory location
  - CVE-2011-0606: Crafted length value in document reader leads to buffer overflow
  - CVE-2011-0651: SSL server overflow when the sum of multiple length fields exceeds a given value