CWE-468ΒΆ

Incorrect Pointer Scaling. [Pointer-Issues, Incorrect-Calculation]

Required inputs: IR

In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
Demonstrative Examples
Example 1

This example attempts to calculate the position of the second byte of a pointer.

Example Language:C
    int *p = x;
    char * second_char = (char *)(p + 1);

In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment.

Excerpts from CWE [https://cwe.mitre.org], Copyright (C) 2006-2026, the MITRE Corporation. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key

Text

Severity

Disabled

scaled_arith

Do not add or subtract a scaled integer to a pointer.

None

False

Options