Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A native memory pointer is retrieved from a Netty ByteBuf by fallback to `internalNioBuffer(0, buffer.capacity())`. JNI's `GetDirectBufferAddress` returns the base address of the shared chunk. By passing the full capacity and ignoring the explicit slice offset (`ByteBuffer.position()`), out-of-bounds access happens on pooled buffers. Calculate memory address
Unchecked subtraction of `sizeof` from a length variable before a memory copy operation. This can lead to integer underflow if the length is smaller than the `sizeof` value, causing an out-of-bounds read/write when passed to `memcpy` or `memmove`. Always validate the length before subtraction.
Using out-of-line libcalls for WebAssembly passive data segment operations (like `memory.init`, `data.drop`, `array.new_data`) is vulnerable to out-of-bounds memory access. The libcalls lack inline unbypassable JIT bounds checking and may race with mutations or yields, leading to unchecked memory accesses. Natively generate checking logic by safely reading p
Integer overflow vulnerability in 2D rectangle bounds checks. When checking if a 2D rectangle is out of bounds, addition of variables (e.g., x + width) can overflow if 32-bit integers are used, wrapping around to a small value and bypassing the bounds check. This can lead to out-of-bounds memory accesses. Use 64-bit integer types (e.g. uint64_t) for bounds c
A reallocation condition checks two parameters but fails to verify a third parameter that is passed to the allocation function. If only the third parameter changes, the reallocation is incorrectly skipped and the object retains stale state. This can lead to out-of-bounds memory accesses.
Advancing a string or stream pointer via `Stream_Seek` without checking its bounds after an alignment calculation allows out-of-bounds skips. This could lead to a crash (e.g. `WINPR_ASSERT`) via unvalidated stream operations. Use `Stream_SafeSeek` instead, which securely enforces bounds limits.
Missing bounds check on WPS fragment length calculation can lead to integer underflow and memory corruption.
A cleanup function was called with an additive duplicate variable expression (`$X + $X`). This is heavily indicative of a typo for a loop index or single variable `$X` (e.g., `i + i` instead of `i`). Calling a cleanup function with an accidentally doubled size or index overestimates initialized bounds, leading to out-of-bounds memory accesses and corrupted m
Unchecked `split_at` or `split_at_mut` on slices can cause a panic if the index represents an out-of-bounds position. When processing untrusted parser inputs or ciphertexts, this missing bounds check triggers Rust unwinding and results in a Denial of Service (DoS). Consider using `split_at_checked` or `split_at_mut_checked` which return an `Option` for safe
A value read from an untrusted buffer is used as a loop boundary for array indexing without being validated against a maximum limit. This missing bound check can lead to out-of-bounds read or write operations, potentially causing heap corruption or information disclosure vulnerabilities (CWE-502, CWE-119, CWE-787). Ensure that boundary limits parsed from unt
Validation of AVRCP vendor command length is insecure. The code either uses AVRC_MIN_CMD_LEN (20 bytes) which is too small for vendor messages (29 bytes), or it relies on assert() for validation which is compiled out in production (NDEBUG) builds. This can lead to heap-based out-of-bounds writes. Replace assert() with a runtime conditional and use a properly
A missing validation check allows parallel reduction to take place underneath a SIMD-vectorized loop, leading to generated C++ code that can encounter a buffer overflow. Ensure parallel reductions are disabled under SIMD-vectorized loops when recalculating the `start_depth` for loops.
A local char buffer is passed to xmlrpc_getstring() but is declared with a hardcoded size instead of CONFIG_XMLRPC_STRINGSIZE+1. xmlrpc_getstring() performs an unbounded strcpy() from an internal buffer of CONFIG_XMLRPC_STRINGSIZE+1 bytes, so any smaller destination can be overflowed by a remote attacker-controlled XML-RPC string parameter (CVE-2025-47869).
Debug assertions (`DCHECK`, `assert`) are compiled out in release builds (e.g., when NDEBUG is defined). Using them exclusively for bounds checking discards the safety guarantee, potentially enabling memory corruption vulnerabilities if out-of-bounds data is processed. Enforce bounds limits using `CHECK`, exceptions, or standard conditional validation that p
Inadequate minimum bounds check on `$LEN`. The variable is allowed to reach a value that causes an integer underflow when `$SUB` is subtracted in the loop condition, potentially leading to out-of-bounds memory access.
Detected an unconditional increment of an index/cursor after a boundary check and reset. This logic causes the cursor to go out of bounds before the check (off-by-one) and skips the 0th element after a reset. Ensure the increment happens in an `else` branch or fix the bounds logic.
