Improper Handling of Inconsistent Structural Elements
Draft Base
Structure: Simple
Description
The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
Common Consequences 1
Scope: IntegrityOther
Impact: Varies by ContextUnexpected State
Demonstrative Examples 1
ID : DX-91
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.Code Example:
Bad
C
c// get message from socket and store into buffer*
cc// process message* success = processMessage(message);} return success;}
However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (Unchecked Input for Loop Condition). If msgLength indicates a length that is longer than the size of a message body (Improper Handling of Length Parameter Inconsistency), then this can result in a buffer over-read by reading past the end of the buffer (Buffer Over-read).
Observed Examples 2
CVE-2014-0160Chain: "Heartbleed" bug receives an inconsistent length parameter (Improper Handling of Length Parameter Inconsistency) enabling an out-of-bounds read (Buffer Over-read), returning memory that could include private cryptographic keys and other sensitive data.
CVE-2009-2299Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Implementation
Related Weaknesses
Taxonomy Mapping
- PLOVER