CWE-788: Access of Memory Location After End of Buffer

Description:
The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

Extended Description:
This typically occurs when a pointer or its index is incremented to a position after the buffer; or when pointer arithmetic results in a position after the buffer.

Affected languages: Memory-Unsafe, C, C++
Parent weaknesses: CWE-119, CWE-119, CWE-119

Consequences:
  - Confidentiality: Read Memory
  - Integrity: Modify Memory
  - Integrity: Modify Memory

Detection methods:
  - Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Demonstrative examples:
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.
void host_lookup(char *user_supplied_addr){ 
                         struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); 
                            
                            /*routine that ensures user_supplied_addr is in the right format for conversion */ 
                            
     

In the following example, it is possible to request that memcpy move a much larger segment of memory than assumed:
If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely available to the destination buffer (CWE-787, CWE-788).
int returnChunkSize(void *) { 
                         
                            
                            /* if chunk info is valid, return the size of usable memory, 
                            
                            
                        

Real-world examples:
  - CVE-2009-2550: Classic stack-based buffer overflow in media player using a long entry in a playlist
  - CVE-2009-2403: Heap-based buffer overflow in media player using a long entry in a playlist
  - CVE-2009-0689: large precision value in a format string triggers overflow
  - CVE-2009-0558: attacker-controlled array index leads to code execution
  - CVE-2008-4113: OS kernel trusts userland-supplied length value, allowing reading of sensitive information