目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-467 在指针类型上使用sizeof() 类漏洞列表 2

CWE-467 在指针类型上使用sizeof() 类弱点 2 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-467 属于内存管理缺陷。当开发者误对指针而非其指向的数据使用 sizeof 时，仅获取指针本身大小而非数据实际大小，导致缓冲区计算错误。攻击者可利用此漏洞触发缓冲区溢出，进而执行任意代码或导致程序崩溃。开发者应确保 sizeof 作用于具体数组或结构体，而非指针变量，以准确计算内存需求，防止此类逻辑错误。

MITRE CWE 官方描述
CWE：CWE-467 在指针类型上使用 sizeof() 英文：代码在指针类型上调用 sizeof()，如果程序员原本意图是确定所指向数据的大小，则可能导致计算错误。 在指针上使用 sizeof() 有时可以生成有用的信息。一个明显的例子是获取平台上的字长（wordsize）。但更常见的情况是，sizeof(pointer) 的出现表明存在一个 bug。
常见影响 (1)
Integrity, ConfidentialityModify Memory, Read Memory
This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.
缓解措施 (1)
ImplementationUse expressions such as "sizeof(*pointer)" instead of "sizeof(pointer)", unless you intend to run sizeof() on a pointer type to gain some platform independence or if you are allocating a variable on the stack.
代码示例 (2)
Care should be taken to ensure sizeof returns the size of the data structure itself, and not the size of the pointer to the data structure.
double *foo; ... foo = (double *)malloc(sizeof(foo));
Bad · C
double *foo; ... foo = (double *)malloc(sizeof(*foo));
Good · C
This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ char *username = "admin"; char *pass = "password"; int AuthenticateUser(char *inUser, char *inPass) { printf("Sizeof username = %d\n", sizeof(username)); printf("Sizeof pass = %d\n", sizeof(pass)); if (strncmp(username, inUser, sizeof(username))) { printf("Auth failure of username using sizeof\n"); return(AUTH_FAIL); } /* Because of CWE-467, the sizeof returns 4 on many platforms and architectures. */ if (! strncmp(pass, inPass, sizeof(pass))) { printf("Auth success of password
Bad · C
pass5 passABCDEFGH passWORD
Attack
CVE ID标题CVSS风险等级Published
CVE-2025-33132 IBM DB2 High Performance Unload 安全漏洞 — DB2 High Performance Unload 6.5 Medium2025-10-27
CVE-2020-1638 Juniper Networks Junos OS和Junos OS Evolved 输入验证错误漏洞 — Junos OS 7.5 High2020-04-08

CWE-467（在指针类型上使用sizeof()） 是常见的弱点类别，本平台收录该类弱点关联的 2 条 CVE 漏洞。