CWE-193 — Off-by-one Error
CWE-193: Off-by-one Error
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Common consequences
- Availability: DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Instability
- Integrity: Modify Memory
- Confidentiality, Availability, Access Control: Execute Unauthorized Code or Commands, Bypass Protection Mechanism
Mitigations
Implementation — When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
References
- CWE page: https://cwe.mitre.org/data/definitions/193.html
- CWE list: https://cwe.mitre.org/data/index.html