CWE-193: Off-by-one Error

What is Off-by-one Error?

• Overview: An off-by-one error occurs when a program incorrectly calculates a boundary value, resulting in a value that is either one more or one less than intended. This can lead to buffer overflows, incorrect logic, or unexpected behavior.

• Exploitation Methods:

• Attackers can exploit off-by-one errors to perform buffer overflows, potentially leading to arbitrary code execution or data corruption.
• Common attack patterns include manipulating input sizes or indices to force the program into an off-by-one condition, allowing control over adjacent memory.

• Security Impact:

• Direct consequences of successful exploitation include memory corruption, application crashes, or unauthorized code execution.
• Potential cascading effects could involve system instability or further vulnerabilities being exposed.
• Business impact might include data breaches, loss of customer trust, and legal liabilities.

• Prevention Guidelines:

• Specific code-level fixes involve carefully validating boundary conditions and using safe functions that handle indices correctly.
• Security best practices include rigorous input validation, thorough code reviews, and boundary testing.
• Recommended tools and frameworks include static analysis tools that detect off-by-one errors, and adopting languages or libraries that provide built-in protections against such errors.

Corgea can automatically detect and fix Off-by-one Error in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: C, Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

// vulnerable_buffer.c {10-13}
// This code demonstrates an off-by-one error vulnerability
#include <stdio.h>
#include <string.h>

void copyString(char *destination, const char *source) {
    size_t length = strlen(source);
    // Incorrect buffer allocation: missing space for null terminator
    // This leads to an off-by-one error when copying the string.
    char buffer[10]; // Buffer size is exactly the length of source assuming it is 9 characters

    // Off-by-one error: does not leave space for null terminator
    strncpy(buffer, source, length); // If length is 10, this overflows buffer
    buffer[length] = '\0'; // Attempt to null-terminate might go out of bounds if length >= 10

    strcpy(destination, buffer);
}

int main() {
    char destination[20];
    copyString(destination, "vulnerable");
    printf("Copied string: %s\n", destination);
    return 0;
}

How to fix Off-by-one Error?

To fix the off-by-one error, ensure that buffer sizes are calculated correctly, especially considering the null terminator for strings in C. In the example above, the buffer was allocated with the same length as the source string, which did not account for the additional space needed for the null terminator. This oversight can lead to buffer overflows, undefined behavior, or even security vulnerabilities, especially if the buffer is adjacent to sensitive data or control structures.

The fix involves correctly allocating the buffer by adding one more byte to accommodate the null terminator. Additionally, the strncpy function should be used with a size argument that includes this extra space, and we should ensure not to write beyond the allocated buffer.

Fixed Code Example

// fixed_buffer.c {10-14}
#include <stdio.h>
#include <string.h>

void copyString(char *destination, const char *source) {
    size_t length = strlen(source);
    // Correct buffer allocation: includes space for null terminator
    char buffer[11]; // Correct buffer size to accommodate null terminator for 10 characters

    // Correct usage of strncpy: copies at most buffer size - 1 characters
    strncpy(buffer, source, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination within bounds

    strcpy(destination, buffer);
}

int main() {
    char destination[20];
    copyString(destination, "vulnerable");
    printf("Copied string: %s\n", destination);
    return 0;
}

In this fixed code example, the buffer is allocated with one extra byte to ensure the null terminator can fit in. The strncpy function is called with a limit of sizeof(buffer) - 1 to prevent writing beyond the buffer's capacity, and the last element of the buffer is explicitly set to '\0' to ensure it is null-terminated. This approach prevents off-by-one errors and ensures safe string handling.