What is Use of sizeof() on a Pointer Type (CWE-467)?

TL;DR: Use of sizeof() on a Pointer Type (CWE-467) is an error where the size of a pointer type is calculated incorrectly, leading to buffer overflows and memory issues. Fix by using sizeof(*pointer).

What is Use of sizeof() on a Pointer Type?

Use of sizeof() on a Pointer Type (CWE-467) is an error where the size of a pointer type is calculated instead of the data pointed to, leading to incorrect buffer sizes. As defined by the MITRE Corporation under CWE-467.

Quick Summary

This vulnerability can cause buffer overflows and other memory issues that compromise system integrity and confidentiality. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Use of sizeof() on a Pointer Type Overview · How Use of sizeof() on a Pointer Type Works · Business Impact of Use of sizeof() on a Pointer Type · Use of sizeof() on a Pointer Type Attack Scenario · How to Detect Use of sizeof() on a Pointer Type · How to Fix Use of sizeof() on a Pointer Type · Framework-Specific Fixes for Use of sizeof() on a Pointer Type · How to Ask AI to Check Your Code for Use of sizeof() on a Pointer Type · Use of sizeof() on a Pointer Type Best Practices Checklist · Use of sizeof() on a Pointer Type FAQ · Vulnerabilities Related to Use of sizeof() on a Pointer Type · References · Scan Your Own Site

Use of sizeof() on a Pointer Type Overview

What: Incorrect calculation of buffer size due to using sizeof() on pointer types. Why it matters: Leads to buffer overflows and memory issues compromising system integrity and confidentiality. Where it occurs: In C, C++, Java, Node.js, Python, PHP applications. Who is affected: Developers who use these languages without proper buffer management techniques. Who is NOT affected: Systems using robust buffer size calculation mechanisms.

How Use of sizeof() on a Pointer Type Works

Root Cause

The root cause lies in the incorrect usage of sizeof() on pointer types instead of dereferencing them to get the actual data size.

Attack Flow

1. An attacker identifies instances where sizeof(pointer) is used.
2. The application allocates insufficient buffer space due to incorrect sizing.
3. Buffer overflow occurs when more data than allocated is written into the buffer.

Prerequisites to Exploit

• Presence of code using sizeof() on pointer types without dereferencing them.
• Lack of proper validation or checks for buffer sizes.

Vulnerable Code

int *ptr = (int*)malloc(sizeof(int*));

This code allocates memory based on the size of a pointer rather than an integer, leading to incorrect buffer sizing.

Secure Code

int *ptr = (int*)malloc(sizeof(*ptr));

Using sizeof(*ptr) ensures that the correct data type size is used for allocation.

Business Impact of Use of sizeof() on a Pointer Type

Confidentiality: Exposes sensitive data through buffer overflows.

• Data corruption leading to unauthorized access. Integrity: Compromises system integrity due to memory issues.
• Corruption of critical system files and configurations. Availability: Disrupts availability by causing crashes or hangs.
• Application instability due to unhandled exceptions.

Use of sizeof() on a Pointer Type Attack Scenario

1. Attacker identifies code using sizeof() on pointer types without dereferencing them.
2. Buffer overflow occurs when more data than allocated is written into the buffer.
3. System crashes or becomes unstable, leading to potential unauthorized access.

How to Detect Use of sizeof() on a Pointer Type

Manual Testing

• Review code for instances where sizeof() is used on pointer types without dereferencing them first.
• Verify that buffer sizes are correctly calculated and validated.

Automated Scanners (SAST / DAST)

Static analysis can detect patterns of incorrect usage, while dynamic testing verifies actual behavior during runtime.

PenScan Detection

PenScan’s ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap engines can identify instances of sizeof() being incorrectly applied to pointer types.

False Positive Guidance

False positives may occur when the code uses sizeof(pointer) in contexts where it is safe or intended behavior.

How to Fix Use of sizeof() on a Pointer Type

• Use sizeof(*pointer) instead of sizeof(pointer).
• Validate buffer sizes before allocation.
• Implement proper error handling and validation mechanisms.

Framework-Specific Fixes for Use of sizeof() on a Pointer Type

int *ptr = (int*)malloc(sizeof(*ptr));

Ensure correct data type size is used for memory allocation in C/C++.

How to Ask AI to Check Your Code for Use of sizeof() on a Pointer Type

Use of sizeof() on a Pointer Type Best Practices Checklist

✅ Always use sizeof(*pointer) to determine the size of data being pointed to. ✅ Validate buffer sizes before allocation. ✅ Implement proper error handling and validation mechanisms.

Use of sizeof() on a Pointer Type FAQ

How does the use of sizeof() on a pointer type lead to incorrect buffer size calculations?

When sizeof() is used on a pointer, it returns the size of the pointer itself rather than the size of the data being pointed to, leading to potential memory allocation issues.

Can you provide an example of vulnerable code for Use of sizeof() on a Pointer Type?

A common mistake is allocating buffer space using sizeof(pointer) instead of sizeof(*pointer), which can result in insufficient buffer sizes and lead to buffer overflows.

How does the use of sizeof() on a pointer type impact system integrity?

Incorrect buffer size calculations can cause data corruption, leading to compromised system integrity as attackers may exploit these vulnerabilities for unauthorized access or code execution.

What are some best practices to prevent Use of sizeof() on a Pointer Type in C++?

Always use sizeof(*pointer) when determining the size of the data being pointed to and not the pointer itself, ensuring correct buffer sizes and preventing potential memory issues.

What are some manual testing steps for detecting Use of sizeof() on a Pointer Type?

Manually review code for instances where sizeof() is used on pointers without dereferencing them first, and verify that buffer sizes are correctly calculated.

How can PenScan help in identifying Use of sizeof() on a Pointer Type vulnerabilities?

PenScan’s automated scanning engines can detect instances of sizeof() being incorrectly applied to pointer types, helping developers quickly identify and fix these issues.

Vulnerabilities Related to Use of sizeof() on a Pointer Type

| CWE | Name | Relationship | |—|—|—| | CWE-131 | Incorrect Calculation of Buffer Size | ChildOf |

References

• MITRE - CWE-467
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of sizeof() on a Pointer Type and other risks before an attacker does.