The product writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The product may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.

Remediation:

• Double check that the buffer is as large as specified.
• When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string.
• Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.
• If necessary, truncate all input strings to a reasonable length before passing them to the copy and concatenation functions.

Metadata

• Severity: medium
• Slug: out-of-bounds-write

CWEs

• 787: Out-of-bounds Write