CWE-469: Use of Pointer Subtraction to Determine Size

BaseDraftExploit Likelihood: Medium

The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
CC++
Platforms

Frequently Asked Questions

What is CWE-469: Use of Pointer Subtraction to Determine Size?+

CWE-469: Use of Pointer Subtraction to Determine Size is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

What are the security consequences of Use of Pointer Subtraction to Determine Size?+

If exploited, CWE-469 (Use of Pointer Subtraction to Determine Size) it can compromise Access Control, Integrity, Confidentiality and Availability, leading to outcomes such as Modify Memory, Read Memory, Execute Unauthorized Code or Commands and Gain Privileges or Assume Identity.

How do you prevent or mitigate Use of Pointer Subtraction to Determine Size?+

Recommended mitigations for CWE-469 include: Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to "walk" from one pointer to the other and calculate the difference. Always validate this number.

Which programming languages are affected by Use of Pointer Subtraction to Determine Size?+

CWE-469 commonly affects C and C++. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-469 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More