CWE-130: Improper Handling of Length Parameter Inconsistency

What is Improper Handling of Length Parameter Inconsistency?

• Overview: CWE-130, known as Improper Handling of Length Parameter Inconsistency, occurs when a software product fails to properly handle or validate length fields that are inconsistent with the actual data length. This means that an application might rely on a length parameter that does not accurately reflect the data’s true size, leading to unexpected behavior.

• Exploitation Methods:

• Attackers can manipulate the length parameter to introduce inconsistencies, leading to potential buffer overflows or other memory corruption issues.
• Common attack patterns include sending inputs that exceed expected sizes or crafting inputs that mislead the application about the true size of the data.

• Security Impact:

• Direct consequences include potential buffer overflows, which can lead to crashes or unauthorized code execution.
• Potential cascading effects include further memory corruption or data leaks that compromise application integrity.
• Business impact might involve data breaches, service outages, or loss of customer trust due to security vulnerabilities.

• Prevention Guidelines:

• Specific code-level fixes include validating length parameters against actual data sizes and ensuring proper bounds checking.
• Security best practices involve using safe libraries for input handling and avoiding reliance on untrusted length fields.
• Recommended tools and frameworks include static analysis tools to identify and correct length parameter inconsistencies and security libraries that offer robust input validation functions.

Corgea can automatically detect and fix Improper Handling of Length Parameter Inconsistency in your codebase. Try Corgea free today.

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: C, C++, Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

#include <stdio.h>
#include <string.h>

void processMessage(char *msg, int length) {
    char buffer[256];
    // Vulnerable: Length parameter is used directly without validation
    if (length > 256) {
        printf("Error: length exceeds buffer size\n");
        return;
    }
    // Vulnerability: No actual check against msg's real length
    strncpy(buffer, msg, length);
    buffer[length] = '\0';
    printf("Processed message: %s\n", buffer);
}

int main() {
    char message[] = "Hello, world!";
    processMessage(message, 50); // Simulate incorrect length
    return 0;
}

Explanation:

• The code above demonstrates improper handling of the length parameter inconsistency.
• The processMessage function takes a msg and a length. It assumes that length accurately represents the size of msg, which is not validated against the actual length of msg.
• This can lead to buffer overflows if length is larger than the actual size of msg, even if it is less than 256.

How to fix Improper Handling of Length Parameter Inconsistency?

To fix this vulnerability, always verify that the length parameter accurately reflects the size of the data it is supposed to represent. In C, this can be done by comparing the provided length with the actual size of the buffer or message. Implement proper checks to ensure that operations like strncpy do not exceed the actual buffer size and the actual length of the data.

Fixed Code Example

#include <stdio.h>
#include <string.h>

void processMessage(char *msg, int length) {
    char buffer[256];
    // Correct: Calculate the actual length of the message
    int actualMsgLength = strlen(msg);
    
    // Validate the provided length against the actual message length
    if (length > 256 || length > actualMsgLength) {
        printf("Error: invalid length parameter\n");
        return;
    }
    
    strncpy(buffer, msg, length);
    buffer[length] = '\0';
    printf("Processed message: %s\n", buffer);
}

int main() {
    char message[] = "Hello, world!";
    processMessage(message, 13); // Correct length
    return 0;
}

Explanation:

• The fixed code calculates the actual length of the message using strlen and compares it with the provided length parameter.
• It ensures that length is not greater than both the buffer size and the actual message length.
• This prevents buffer overflow and ensures safe handling of length parameters, adhering to best practices for secure C programming.