CWE-131—Incorrect Calculation of Buffer Size
PUBLISHEDweakness recordHigh
released 2006-07-19 · last modified 2025-12-11
Metadata
- CWE ID：
- CWE-131
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-12-11
名称
Incorrect Calculation of Buffer Size
描述
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
常见后果
- 范围：
- Integrity, Availability, Confidentiality
- 影响：
- DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Read Memory, Modify Memory
- 注释：
- If the incorrect calculation is used in the context of memory allocation, then the software may create a buffer that is smaller or larger than expected. If the allocated buffer is smaller than expected, this could lead to an out-of-bounds read or write (CWE-119), possibly causing a crash, allowing arbitrary code execution, or exposing sensitive data.