CWE-789: Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
How it's found
Memory Allocation with Excessive Size Value is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Vulnerable vs. safe
int pre_len = sizeof("preamble: "); // Note space at the end of the string - assume all strings have preamble with space
char buf[pre_len - msg_len];
... Do processing here and set status
return status;int proc_msg(char *s, int msg_len){}char *s = "preamble: message\n";char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space)int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero lengthint ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stackint pre_len = sizeof("preamble: "); // Note space at the end of the string - assume all strings have preamble with space
if (pre_len <= msg_len) { // Log error; return error_code; }
char buf[pre_len - msg_len];
... Do processing here and set status
return status;int proc_msg(char *s, int msg_len){}char *s = "preamble: message\n";char *sl = strchr(s, ':'); // Number of characters up to ':' (not including space)int jnklen = sl == NULL ? 0 : sl - s; // If undefined pointer, use zero lengthint ret_val = proc_msg ("s", jnklen); // Violate assumption of preamble length, end up with negative value, blow out stackConsequences
- DoS: Resource Consumption (Memory): Not controlling memory allocation can result in a request for too much system memory, possibly leading to a crash of the application due to out-of-memory conditions, or the consumption of a large amount of memory on the system.
Mitigations
- Implementation/Architecture and Design: Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-789?
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
How do you find Memory Allocation with Excessive Size Value?
Memory Allocation with Excessive Size Value is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-789?
DoS: Resource Consumption (Memory): Not controlling memory allocation can result in a request for too much system memory, possibly leading to a crash of the application due to out-of-memory conditions, or the consumption of a large amount of memory on the system.
Does TurboPentest test for Memory Allocation with Excessive Size Value?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest