CWE-467—Use of sizeof() on a Pointer Type

名称

Use of sizeof() on a Pointer Type

描述

The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.

The use of sizeof() on a pointer can sometimes generate useful information. An obvious case is to find out the wordsize on a platform. More often than not, the appearance of sizeof(pointer) indicates a bug.

常见后果

范围：

Integrity, Confidentiality

影响：

Modify Memory, Read Memory

注释：

This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.

相关 CWE

• CWE-131Incorrect Calculation of Buffer SizeHigh