Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-469 (使用指针的减法来确定大小) — Vulnerability Class 1

1 vulnerabilities classified as CWE-469 (使用指针的减法来确定大小). AI Chinese analysis included.

CWE-469 represents a logical weakness where software incorrectly calculates memory size by subtracting two pointers, assuming they reside within the same contiguous memory block. This flaw typically arises when developers derive buffer lengths from arbitrary pointers that may point to unrelated or non-contiguous data structures. Exploitation often leads to severe memory corruption, such as buffer overflows or underflows, because the resulting size calculation is inaccurate, causing subsequent read or write operations to access out-of-bounds memory regions. Attackers can leverage these miscalculations to execute arbitrary code or crash the application. To prevent this vulnerability, developers should explicitly track and pass buffer sizes alongside pointers rather than inferring them through arithmetic. Additionally, using safe, high-level abstractions that manage memory bounds automatically ensures that size calculations remain accurate and secure, eliminating the risk associated with pointer arithmetic assumptions.

MITRE CWE Description
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
Common Consequences (1)
Access Control, Integrity, Confidentiality, AvailabilityModify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity
There is the potential for arbitrary code execution with privileges of the vulnerable program.
Mitigations (1)
ImplementationSave an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to "walk" from one pointer to the other and calculate the difference. Always validate this number.
Examples (1)
The following example contains the method size that is used to determine the number of nodes in a linked list. The method is passed a pointer to the head of the linked list.
struct node { int data; struct node* next; }; // Returns the number of nodes in a linked list from // the given pointer to the head of the list. int size(struct node* head) { struct node* current = head; struct node* tail; while (current != NULL) { tail = current; current = current->next; } return tail - head; } // other methods for manipulating the list ...
Bad · C
... int size(struct node* head) { struct node* current = head; int count = 0; while (current != NULL) { count++; current = current->next; } return count; }
Good · C
CVE IDTitleCVSSSeverityPublished
CVE-2019-25595 jetAudio 8.1.7.20702 Basic Denial of Service via URL Handler — jetAudio 6.2 Medium2026-03-22

Vulnerabilities classified as CWE-469 (使用指针的减法来确定大小) represent 1 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.