CWE-135: Incorrect Calculation of Multi-Byte String Length

MITRE CWE weakness

Description

The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

Common consequences

• Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands
• Availability, Confidentiality: Read Memory, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)
• Confidentiality: Read Memory

Mitigations

Implementation — Always verify the length of the string unit character.

Implementation — Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)

References

• CWE page: https://cwe.mitre.org/data/definitions/135.html
• CWE list: https://cwe.mitre.org/data/index.html