Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Ruby C extension method unwraps a Ruby object argument into a C struct without verifying its type via `rb_obj_is_kind_of`, potentially leading to type confusion and out-of-bounds memory access.
Unvalidated Visited-PLMN-Id AVP data pointer and length passed directly to ogs_auc_kasme. A Diameter request with a missing or truncated Visited-PLMN-Id AVP can cause out-of-bounds memory access or null pointer dereference. Validate the AVP length against OGS_PLMN_ID_LEN and copy to a validated buffer before calling ogs_auc_kasme.
When discarding an oversized packet payload, returning a positive packet length rather than an error status causes callers to treat uninitialized buffer memory as valid packet data, leading to out-of-bounds reads.
Bit index is erroneously divided by 8 when supplied as a bit offset to tvb_get_bits*, causing unit mismatch and potential out-of-bounds read.
LZO compressed extent length validation checks for only a single header (srclen < LZO_LEN) instead of both the extent and segment headers (LZO_LEN * 2), allowing out-of-bounds reads on crafted inputs.
Flawed bounds check: relative MQTT property offset is checked against props_start + props_size instead of props_size, allowing out-of-bounds reads.
A length parameter is clamped using `std::min` to calculate a safe length, but the original unclamped variable is passed to `memcpy`. This can cause an out-of-bounds read or write.
Missing length validation when processing Rock Ridge SUSP records. The record length is used but not validated against the minimum record size (4 bytes) or the remaining buffer space, which can lead to boundary check bypasses, infinite loops, or CPU exhaustion.
Uncompressed image encoder processes planar components without validating component plane dimensions against primary image dimensions, which can lead to heap buffer overflow.
64-bit chunk.unpacked_size is passed to internal_decode_alloc_buffer without checking if it exceeds size_t capacity on 32-bit architectures, which can lead to integer truncation and out-of-bounds heap operations.
A byte array is passed into a method or processed by a bounds check wrapper without sound bounds validation. Using `off + len - 1` can cause integer overflow, and skipping checks when `len == 0` can bypass offset boundaries. Attackers can trigger out-of-bounds reads/writes in native code relying on this, leading to information disclosure or JVM crashes. Use
Calculating row pointers from `_base` in OpenEXR channel classes leads to out-of-bounds pointer calculations when the data window origin is non-zero. Use the direct buffer pointer (`_pixels`, `_sampleListPointers`, or `_numSamples`) instead.
TypedImageChannel::row() uses the origin-adjusted _base pointer instead of the backing buffer pointer, leading to out-of-bounds memory read/write for non-zero data window origins.
Potential 32-bit integer overflow in 2D coordinate pointer calculation. Using 32-bit signed integers for dimension variables and loop indices when computing buffer offsets can overflow with large dimensions. Use `int64_t` or `size_t` for dimensions and loop counters.
A boundary check only validates the upper bound of a slice but fails to check for negative indices. If the index can be user-controlled, this can lead to an out-of-bounds panic. Ensure you also check that the index is >= 0.
A backward-searching loop decrements a pointer while inspecting its preceding character, but lacks a lower-bound check. This can lead to a heap buffer underread if the expected stopping character is absent. Ensure the pointer is checked against the start of the buffer (e.g., `ptr > start`) before dereferencing.
OBJ_obj2txt returns the full required string length, not the number of bytes actually written to the buffer. If an attacker controls the input, this return value can exceed the allocated buffer size. Passing it directly as a length argument to read operations causes an out-of-bounds read. Size the buffer to the required length first, then format, and store t
The libsyck lexing functions `is_newline` and `newline_len` are inherently unsafe when called with a single argument because they internally dereference the pointer and potentially the subsequent byte without verifying memory bounds. This enables out-of-bounds reads during untrusted YAML document parsing. Ensure you adopt the fully patched libsyck which intr
A validation condition only checks the lower bounds (< 0) of indices, omitting an upper bounds check. Using these unbounded indices in subsequent array access or structure mutations can cause out-of-bounds read/write vulnerabilities.
A buffer offset is incorrectly reused as the length parameter in a memory copy operation. If this offset represents an index where a substring was found, it does not correspond to the remaining data length. This mismatch can result in reading beyond the end of the source buffer, leading to an out-of-bounds read and potential memory corruption. Calculate the
Consecutive stream read macros or functions are called without prior bounds checking in the same block, potentially leading to an out-of-bounds read.
Dimensions parsed from input are multiplied to allocate a vector without verifying that the input buffer length (end - start) is sufficient for the requested number of elements.
Byte slice index or slice expression accessed before validating slice length with len(). This can trigger an out-of-bounds slice access panic on unexpected or truncated input.
Calculating the width of the last element in a buffer by subtracting its offset from the total buffer size may cause out-of-bounds reads or information disclosure if the buffer includes trailing alignment padding. Verify if the size should be calculated directly based on the element's parsed structure rather than buffer bounds.
