CWE-785 — Use of Path Manipulation Function without Maximum-sized Buffer
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
Passing an inadequately-sized output buffer to a path manipulation function can result in a buffer overflow. Such functions include realpath(), readlink(), PathAppend(), and others.
Common consequences
- Integrity, Confidentiality, Availability: Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart
Mitigations
Implementation — Always specify output buffers large enough to handle the maximum-size possible result from path manipulation functions.
References
- CWE page: https://cwe.mitre.org/data/definitions/785.html
- CWE list: https://cwe.mitre.org/data/index.html