CWE-704: Incorrect Type Conversion or Cast

Causes

• In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number. If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers.
• The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type. The code intends to process the message as a NAME_TYPE, and sets the default message to "Hello World." However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.,As a result, modification of buf.nameID - an int - can effectively modify the pointer that is stored in buf.name - a string.,Execution of the program might generate output such as:,[object Object],Notice how the pointer for buf.name was changed, even though buf.name was not explicitly modified.,In this case, the first "H" character of the message is omitted. However, if an attacker is able to fully control the value of buf.nameID, then buf.name could contain an arbitrary pointer, leading to out-of-bounds reads or writes.

Remediation

• Use safe APIs
• Centralize the control
• Add regression tests
• Review logs and telemetry for attempted abuse

Detection

• Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.

Related CWEs

• CWE-1389: Incorrect Parsing of Numbers with Different Radices
• CWE-588: Attempt to Access Child of a Non-structure Pointer
• CWE-681: Incorrect Conversion between Numeric Types
• CWE-681: Incorrect Conversion between Numeric Types
• CWE-664: Improper Control of a Resource Through its Lifetime
• CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
• CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

Related CVEs

Related CVE mappings appear after CVE records are cross-indexed.

ATT&CK Relevance

ATT&CK relevance is shown only when reviewed or responsibly inferred.