Off-by-one error in buffer size calculation
ID |
c.buffer_overflow.off_by_one |
Severity |
low |
Resource |
Buffer Overflow |
Language |
C / C++ |
Description
The software calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Rationale
The software calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
The following code illustrates a vulnerable pattern detected by this rule:
void bad1(char *string)
{
char buf[BUFSIZE];
strncpy(buf, string, BUFSIZE);
// VULNERABLE: Off-by-one error in buffer size calculation
buf[BUFSIZE] = '\0';
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.