The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2021-24018
buffer underwrite in firmware verification routine allows code execution via a crafted firmware image
CVE: CVE-2002-2227
Unchecked length of SSLv2 challenge value leads to buffer underflow.
CVE: CVE-2007-4580
Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
CVE: CVE-2007-1584
Buffer underflow from an all-whitespace string, which causes a counter to be decremented before the buffer while looking for a non-whitespace character.
CVE: CVE-2007-0886
Buffer underflow resultant from encoded data that triggers an integer overflow.
CVE: CVE-2006-6171
Product sets an incorrect buffer size limit, leading to "off-by-two" buffer underflow.
CVE: CVE-2006-4024
Negative value is used in a memcpy() operation, leading to buffer underflow.
CVE: CVE-2004-2620
Buffer underflow due to mishandled special characters
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.
Body: However, this function can cause a buffer underwrite if the input character string contains all whitespace. On some systems the while statement will move backwards past the beginning of a character string and will call the isspace() function on an address outside of the bounds of the local buffer.
char* trimTrailingWhitespace(char *strMessage, int length) { char *retMessage; char *message = malloc(sizeof(char)*(length+1)); // copy input string to a temporary string char message[length+1]; int index; for (index = 0; index < length; index++) { message[index] = strMessage[index]; } message[index] = '\0'; // trim trailing whitespace int len = index-1; while (isspace(message[len])) { message[len] = '\0'; len--; } // return string without trailing whitespace retMessage = message; return retMessage; }Intro: The following is an example of code that may result in a buffer underwrite. This code is attempting to replace the substring "Replace Me" in destBuf with the string stored in srcBuf. It does so by using the function strstr(), which returns a pointer to the found substring in destBuf. Using pointer arithmetic, the starting index of the substring is found.
Body: In the case where the substring is not found in destBuf, strstr() will return NULL, causing the pointer arithmetic to be undefined, potentially setting the value of idx to a negative number. If idx is negative, this will result in a buffer underwrite of destBuf.
int main() { ... char *result = strstr(destBuf, "Replace Me"); int idx = result - destBuf; strcpy(&destBuf[idx], srcBuf); ... }