Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Incorrect rewind offset `(j - 1)` instead of `j` in partial string match failure can lead to undersized buffer allocation and subsequent heap buffer overflow.
Heap buffer allocation size calculated from string length and un-escaped character counts may under-count required bytes when parsing complex path strings, leading to a heap out-of-bounds write.
The output buffer for EVP_CipherUpdate is allocated using only the queried output length rather than accommodating the input length. In key-unwrap modes such as AES-WRAP-PAD, integrity failures can write and cleanse up to the input length, causing an out-of-bounds heap write.
Manual PMR allocate call with multiplication by sizeof(...) can lead to integer overflow and heap buffer allocation of undersized memory. Prefer using RAII containers (such as std::vector with polymorphic_allocator) or validating bounds before allocating.
Potential heap buffer overflow: channel sample buffers are allocated based on input header channels instead of output header channels, which can lead to undersized buffer allocation when pixel conversion occurs.
Heap buffer allocation for inherited security descriptor uses static or incomplete slack estimation without accounting for dynamic CREATOR_OWNER and CREATOR_GROUP ACE expansions, potentially causing a heap buffer overflow.
A buffer offset is incorrectly reused as the length parameter in a memory copy operation. If this offset represents an index where a substring was found, it does not correspond to the remaining data length. This mismatch can result in reading beyond the end of the source buffer, leading to an out-of-bounds read and potential memory corruption. Calculate the
Using 'sizeof' on a pointer cast returns the size of the pointer itself (e.g., 4 or 8 bytes), not the size of the underlying array or buffer. This causes incorrect buffer length calculations, leading to truncations or buffer overflows. Pass the correct buffer capacity or use 'sizeof' directly on the array.
A dynamic length check correctly identifies that the remaining buffer is smaller than the required size, but triggers a flush/reallocation method without passing the required size. If the reallocation uses a predefined fixed size chunk, memory overrun can occur when formatting the string. Ensure that the computed required size is propagated.
An allocation size calculation is stored in a 32-bit (or smaller) integer variable. This can cause an integer overflow or silent truncation (if `sizeof` or other 64-bit types are involved). A wraparound leads to allocating an unexpectedly small buffer, which can cause a heap-based buffer overflow when data is written to it. Ensure allocation sizes are typed
A pointer's size is incorrectly used instead of the pointed-to structure's size when advancing a buffer offset. This leads to incorrect buffer size calculation, allowing out-of-bounds reads or buffer overflows. Use sizeof(*pointer) instead of sizeof(pointer).
Remaining buffer capacity is calculated using strlen() instead of sizeof(), which can cause an unsigned integer underflow when subtracting string lengths, leading to buffer overflow vulnerabilities.
The `Array` heap-value-type variant stores its `size` as a raw `u32`, discarding the element-type-aware semi-flattened slot count. When the inner element type is composite (a tuple/struct that occupies multiple Brillig slots per element), allocations sized from this raw count under-allocate the heap buffer and allow out-of-bounds writes when foreign-call/ora
Potential heap-based buffer overflow: buffer is allocated with QUERYMAXLEN instead of ENC_QUERYSTR while downstream string construction may write up to ENC_QUERYSTR bytes.
Initializing a TryEntitySet (which uses direct array indexing based on the element's index value) with a capacity equal to the `.len()` of a sparse or filtered map may result in an insufficient capacity. `len()` represents the number of elements, but `TryEntitySet::with_capacity` expects a maximum possible index length. If the map doesn't contain all contigu
Calls to `GetAnsiSize` calculate string length based on wide-character counts rather than actual UTF-8 byte counts. This causes buffer under-allocations and out-of-bounds writes (such as stack buffer overflows) on non-Windows platforms. Use `GetUtf8Size` instead, which properly accounts for multi-byte lengths and null terminators.
Incorrect size calculation for strncat/g_strncat. Subtracting the length of the source string from the total size rather than the length of the destination buffer fails to account for data already accumulated in the destination. This can lead to a heap-based buffer overflow. Calculate the remaining size using the destination string length (e.g., size - 1 - s
A codec decodes an item length but fails to validate it against the allocated output buffer size before decoding the items into memory. This can lead to a heap or stack buffer overflow when an attacker supplies a byte array length larger than the buffer bounds.
An incorrect buffer size calculation for formatting a list of IPv6 addresses leaves no space for a null terminator, leading to a heap buffer overflow. Removing the `- 1` subtraction and explicitly adding space for string termination prevents this corruption.
A buffer expansion function is called inside a conditional before a memmove-based prepend (memmove(ptr + len, ptr, filled) / memmove(ptr, src, len)). If the guard condition does not verify that the buffer has at least 'filled + len' bytes of free capacity – i.e., it only checks whether any free space exists rather than enough free space for 'len' additional
Checking for integer multiplication overflow by testing if the result is less than zero is insecure. Unlike addition, multiplication can easily overflow past the negative range and wrap around to a small positive number (positive wraparound). This effectively bypasses a `< 0` check and can lead to undersized buffer allocations. Verify bounds before multiplic
Sizing a buffer using the return value of hv_iterinit() before iterating with hv_iternext() can lead to a heap buffer overflow when processing tied Perl hashes. Use dynamic buffer reallocation or ignore the count from hv_iterinit().
Detected a potential integer truncation when computing a byte size from an element size and count. By computing `sizeof(T) * count` and implicitly or explicitly mapping it to a 32-bit integer, the product can overflow the 32-bit limit on platforms where size_t is 64 bits. This results in a severely shorter computed length. If this truncated value is subseque
Bit-vs-byte unit confusion in bounds check against MAX_AIS_LENGTH. The constant MAX_AIS_LENGTH is defined in bits (MAX_AIS_BYTES * 8 = 1024), but shifting the index by `>> 3` converts it to bytes before the comparison. The guard therefore only fires when the bit index reaches ~8x the real buffer capacity, permitting a heap buffer overflow in the subsequent b
