-
Notifications
You must be signed in to change notification settings - Fork 116
Closed
Description
Tracking issue for:
src/emulate.c:713
This pointer might have typeunsigned long
(size 8), but this pointer arithmetic is done with type uint32_t * (size 4).
Pointer arithmetic in C and C++ is automatically scaled according to the size of the data type. For example, if the type of p isT*
andsizeof(T) == 4
then the expressionp+1
adds 4 bytes to p. This can cause a buffer overflow condition if the programmer forgets that they are adding a multiple ofsizeof(T)
, rather than a number of bytes.
This query finds pointer arithmetic expressions where it appears likely that the programmer has forgotten that the offset is automatically scaled.
Common Weakness Enumeration: CWE-468.
Metadata
Metadata
Assignees
Labels
No labels