What is Incorrect Calculation of Multi-Byte (CWE-135)?

TL;DR: Incorrect Calculation of Multi-Byte String Length (CWE-135) occurs when the product doesn’t correctly calculate the length of strings that can contain wide or multi-byte characters, leading to buffer overflows and other security issues. You can prevent CWE-135 by always verifying the length of the string unit character and using length computing functions appropriately with their equivalent type.

At-a-Glance

What is Incorrect Calculation of Multi-Byte String Length?

Incorrect Calculation of Multi-Byte String Length (CWE-135) is a type of vulnerability that occurs when the product doesn’t correctly calculate the length of strings that can contain wide or multi-byte characters, leading to buffer overflows and other security issues. As defined by the MITRE Corporation under CWE-135, and classified by the OWASP Foundation as not directly mapped, this vulnerability can have serious consequences.

Quick Summary

Incorrect Calculation of Multi-Byte String Length (CWE-135) is a critical vulnerability that can lead to buffer overflows and other security issues. This occurs when the product doesn’t correctly calculate the length of strings that can contain wide or multi-byte characters. You can prevent CWE-135 by always verifying the length of the string unit character and using length computing functions appropriately with their equivalent type.

Jump to: Quick Summary · Incorrect Calculation of Multi-Byte String Length Overview · How Incorrect Calculation of Multi-Byte String Length Works · Business Impact of Incorrect Calculation of Multi-Byte String Length · Incorrect Calculation of Multi-Byte String Length Attack Scenario · How to Detect Incorrect Calculation of Multi-Byte String Length · How to Fix Incorrect Calculation of Multi-Byte String Length · Framework-Specific Fixes for Incorrect Calculation of Multi-Byte String Length · How to Ask AI to Check Your Code for Incorrect Calculation of Multi-Byte String Length · Incorrect Calculation of Multi-Byte String Length Best Practices Checklist · Incorrect Calculation of Multi-Byte String Length FAQ · Vulnerabilities Related to Incorrect Calculation of Multi-Byte String Length · References · Scan Your Own Site

Incorrect Calculation of Multi-Byte String Length Overview

What

Incorrect Calculation of Multi-Byte String Length (CWE-135) occurs when the product doesn’t correctly calculate the length of strings that can contain wide or multi-byte characters.

Why it matters

This vulnerability can lead to buffer overflows and other security issues, including execute unauthorized code or commands, read memory, DoS: crash, exit, or restart, DoS: resource consumption (CPU), and DoS: resource consumption (memory).

Where it occurs

This vulnerability can occur in any product that uses string functions, character encoding, or multi-byte strings.

Who is affected

Any user of the product can be affected by this vulnerability.

Who is NOT affected

Users who do not use products with string functions, character encoding, or multi-byte strings are not affected by this vulnerability.

How Incorrect Calculation of Multi-Byte String Length Works

Root Cause

The root cause of CWE-135 is the incorrect calculation of the length of strings that can contain wide or multi-byte characters.

Attack Flow

1. The attacker sends a malicious input to the product.
2. The product incorrectly calculates the length of the string, leading to a buffer overflow.
3. The attacker exploits the buffer overflow to execute unauthorized code or commands.

Prerequisites to Exploit

• The product must use string functions, character encoding, or multi-byte strings.
• The attacker must send a malicious input to the product.

Vulnerable Code

def calculate_length(s):
    return len(s)

This code calculates the length of a string using the len() function. However, it does not correctly handle wide or multi-byte characters.

Secure Code

import unicodedata

def calculate_length(s):
    return len(unicodedata.normalize('NFKD', s))

This code uses the unicodedata module to normalize the string before calculating its length. This ensures that the correct length is calculated even for wide or multi-byte characters.

Business Impact of Incorrect Calculation of Multi-Byte String Length

Confidentiality

• The product may expose sensitive information, such as passwords or credit card numbers.
• The attacker may be able to read memory and access sensitive data.

Integrity

• The product may allow the attacker to modify sensitive data, such as configuration files or database records.
• The attacker may be able to execute unauthorized code or commands, leading to integrity issues.

Availability

• The product may become unavailable due to a buffer overflow or other security issue.
• The attacker may be able to cause resource consumption (CPU) or memory), leading to availability issues.

Incorrect Calculation of Multi-Byte String Length Attack Scenario

1. The attacker sends a malicious input to the product.
2. The product incorrectly calculates the length of the string, leading to a buffer overflow.
3. The attacker exploits the buffer overflow to execute unauthorized code or commands.

How to Detect Incorrect Calculation of Multi-Byte String Length

Manual Testing

• Use manual testing to identify products that use string functions, character encoding, or multi-byte strings.
• Test the product with malicious inputs to identify potential vulnerabilities.

Automated Scanners (SAST / DAST)

• Use automated scanners to identify potential vulnerabilities in the product.
• These scanners can detect buffer overflows and other security issues related to CWE-135.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.
• PenScan detection can help identify products that are vulnerable to CWE-135.

False Positive Guidance

• Be cautious when interpreting results from automated scanners, as false positives may occur.
• Use manual testing and code review to verify the presence of CWE-135 in the product.

How to Fix Incorrect Calculation of Multi-Byte String Length

• Always verify the length of the string unit character.
• Use length computing functions appropriately with their equivalent type.

Framework-Specific Fixes for Incorrect Calculation of Multi-Byte String Length

Java

import java.text.Normalizer;

public class CalculateLength {
    public static int calculateLength(String s) {
        return Normalizer.normalize(s, Normalizer.NFKD).length();
    }
}

This code uses the Normalizer class to normalize the string before calculating its length.

Node.js

const unicode = require('unicode');

function calculateLength(s) {
    return unicode.normalize(s, 'NFKD').length;
}

This code uses the unicode module to normalize the string before calculating its length.

How to Ask AI to Check Your Code for Incorrect Calculation of Multi-Byte String Length

Review the following [language] code block for potential CWE-135 Incorrect Calculation of Multi-Byte String Length vulnerabilities and rewrite it using length computing functions appropriately with their equivalent type:

def calculate_length(s):
    return len(s)

Rewrite this code to use the unicodedata module to normalize the string before calculating its length:

import unicodedata

def calculate_length(s):
    return len(unicodedata.normalize('NFKD', s))

Incorrect Calculation of Multi-Byte String Length Best Practices Checklist

✅ Always verify the length of the string unit character. ✅ Use length computing functions appropriately with their equivalent type.

Incorrect Calculation of Multi-Byte String Length FAQ

How does CWE-135 occur?

CWE-135 occurs when the product doesn’t correctly calculate the length of strings that can contain wide or multi-byte characters, leading to buffer overflows and other security issues.

What are the common consequences of CWE-135?

The common consequences of CWE-135 include execute unauthorized code or commands, read memory, DoS: crash, exit, or restart, DoS: resource consumption (CPU), and DoS: resource consumption (memory).

How can I prevent CWE-135?

You can prevent CWE-135 by always verifying the length of the string unit character and using length computing functions appropriately with their equivalent type.

What are the related weaknesses to CWE-135?

The related weakness to CWE-135 is CWE-682: Incorrect Calculation (ChildOf).

How can I detect CWE-135?

You can detect CWE-135 by using manual testing, automated scanners (SAST / DAST), and PenScan detection.

What are the framework-specific fixes for CWE-135?

The framework-specific fixes for CWE-135 include using length computing functions appropriately with their equivalent type and verifying the length of the string unit character.

How can I ask AI to check my code for CWE-135?

You can ask AI to check your code for CWE-135 by reviewing the following [language] code block for potential CWE-135 Incorrect Calculation of Multi-Byte String Length vulnerabilities and rewriting it using length computing functions appropriately with their equivalent type.

What are the best practices for preventing CWE-135?

The best practices for preventing CWE-135 include always verifying the length of the string unit character, using length computing functions appropriately with their equivalent type, and input validation.

Vulnerabilities Related to Incorrect Calculation of Multi-Byte String Length

References

• MITRE
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Incorrect Calculation of Multi-Byte String Length and other risks before an attacker does.