CWE-122 (堆缓冲区溢出) — Vulnerability Class 2206

CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.