Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A size value is explicitly cast to `int` before being added to a base offset in a bounds check. If the size is large enough (> 0x7FFFFFFF), it will wrap around to a negative number, potentially bypassing the bounds check completely. Validate the uncasted variable bounds against the boundary limits before performing this truncation.
An allocation size calculation is stored in a 32-bit (or smaller) integer variable. This can cause an integer overflow or silent truncation (if `sizeof` or other 64-bit types are involved). A wraparound leads to allocating an unexpectedly small buffer, which can cause a heap-based buffer overflow when data is written to it. Ensure allocation sizes are typed
An arithmetic operation evaluating before a type cast can cause an integer overflow. When calculating values of smaller types (like `byte` or `uint32`) before casting them to `int`, the arithmetic might exceed the maximum capacity of the smaller type and wrap around. This causes the subsequent bound checks to evaluate an incorrect, significantly smaller valu
Calling `decNumberFromString` with an unbounded string can lead to an integer overflow in the underlying decNumber library when parsing extremely long numeric literals. This can subsequently result in Out-of-Bounds memory writes. Ensure the string length is strictly validated against a maximum bound before parsing.
A static struct pointer is initialized to NULL and populated via a separate initialization function, creating a per-translation-unit accessor/dispatch table. When table entries use per-translation-unit const struct instances as type or mode tokens compared by pointer identity, cross-shared-library comparisons silently return false, selecting the wrong conver
Capacity calculations using unchecked arithmetic (`+`, `*`) can overflow, causing insufficient allocation and potential out-of-bounds access. If the buffer is unexpectedly truncated, subsequent operations assuming un-wrapped dimensions can trigger Undefined Behavior. Use `checked_add` and `checked_mul` to compute buffer dimensions safely securely.
Checking for integer overflow after a multiplication has occurred can lead to undefined behavior if the variables are signed. Modern compilers may optimize away these checks since signed integer overflow is undefined. To prevent this, verify that the operation will not overflow before performing it, using division (e.g., `if (X != 0 && Y > INT_MAX / X)`).
Directly casting the result of `atoi()` to a 16-bit integer (like `unsigned short`) can lead to integer truncation if the parsed value exceeds 65535. This type of truncation in port parsing is a common cause of Server-Side Request Forgery (SSRF) port confusion vulnerabilities. Ensure the parsed integer is bounds-checked before being cast, for example by usin
A signed integer is checked for negativity and then compared against a division (typically representing an upper capacity limit like SIZE_MAX / size) without an explicit cast. This can cause signed/unsigned type promotion issues, leading to potential integer overflows or critical static analyzer warnings. Explicitly cast the signed integer to an unsigned typ
Implicitly comparing a signed integer with a size division (like `SIZE_MAX / element_size`) can lead to signedness/promotion mismatches on mixed-bit architectures (e.g., 32-bit `size_t` vs 64-bit signed int). This can unexpectedly evaluate to false and bypass memory allocation overflow checks. Explicitly cast the signed integer to an unsigned 64-bit type (e.
A potentially signed integer is compared against an overflow threshold derived from SIZE_MAX, without an explicit cast. This implicit signed-to-unsigned conversion can lead to unsafe evaluations of negative boundaries or trigger compiler warnings. Explicitly cast the signed variable sequentially to an unsigned type (e.g., `static_cast<uint64_t>(...)`) before
A signed integer is used to compute memory size via multiplication, passed to an allocation function, and then used to calculate memory offsets. When the multiplication overflows, the signed integer becomes negative. This causes out-of-bounds pointer arithmetic during memory operations, leading to arbitrary memory modification. Use `size_t` for size tracking
A boundary validation check comparing a potentially signed integer against `SIZE_MAX / $Y` without explicitly casting it to an unsigned integer format was detected. Due to implicit C++ type promotion rules, the bounds condition may evaluate unsafely depending on integer widths, potentially allowing out-of-bounds large integer sizes to bypass validation. This
A potentially signed value is compared directly against an unsigned maximum limit (`SIZE_MAX / $SIZE`). This can lead to type promotion issues where the signed integer is implicitly cast, potentially enabling integer overflows to bypass bounds checks. Explicitly cast the signed value to an unsigned integer type before making the comparison.
Implicit mixed-type comparison between a signed integer and an unsigned maximum bound can trigger compiler-dependent type promotion issues, resulting in unreliable overflow checks. Explicitly cast the signed integer to an unsigned type (e.g., `uint64_t`) before the comparison.
Subtracting an expression from a buffer size to calculate the remaining length without a prior bounds check can cause an integer underflow. This bypasses bounds checks and leads to out-of-bounds accesses.
Integer overflow vulnerability in 2D rectangle bounds checks. When checking if a 2D rectangle is out of bounds, addition of variables (e.g., x + width) can overflow if 32-bit integers are used, wrapping around to a small value and bypassing the bounds check. This can lead to out-of-bounds memory accesses. Use 64-bit integer types (e.g. uint64_t) for bounds c
Using `1 << $SHIFT` to compute a loop bound is vulnerable to integer overflow. In Java, the integer literal `1` is a 32-bit signed integer. If `$SHIFT` evaluates to 31, the result is Integer.MIN_VALUE (a negative number). When used as a loop upper bound, this causes the loop to execute zero times, which can silently bypass critical logic (e.g., in BCrypt key
Unrestricted 'indent' parameter is multiplied by a nesting depth variable without bounds or sign checking. This can cause an integer overflow leading to a buffer overflow, or an underflow leading to an infinite loop. Ensure 'indent' is explicitly checked (e.g., `indent > 0`) before multiplication.
Using `.expect()` or `.unwrap()` on the result of a checked arithmetic operation (e.g., `checked_add`, `checked_sub`) causes a runtime panic on overflow/underflow. When processing untrusted input, this leads to Denial of Service (DoS) due to reachable assertions. Handle the error gracefully using `.ok_or(...)?` or a `match` statement.
Unchecked addition in bounds or capacity check. If the addition wraps around due to integer overflow, the bounds check might incorrectly succeed. In Rust release mode, standard addition wraps. This can lead to incorrect state invariants, undersized buffer allocations, out-of-bounds writes, and Undefined Behavior. Use `.checked_add()` and handle the overflow
Missing integer bounds checks before arithmetic on an externally read size and subsequent memory allocation. This could lead to integer overflow/underflow, resulting in an undersized allocation and a potential heap out-of-bounds write.
Using 16-bit `short` integers for tracking the number of outline points (`n_points`) or contours (`n_contours`) can lead to integer overflow when processing complex vector graphics formats (like Lottie or SVG) with more than 32,767 items. This causes miscalculation of allocation bounds and out-of-bounds memory writes. Upgrade the structure types and explicit
A signed integer is compared against an unsigned size limit (SIZE_MAX / expression) without explicitly casting the signed integer. This may cause implicit signed-to-unsigned conversions to behave unexpectedly, allowing memory bounds checks to be bypassed. Always cast the signed integer to an unsigned type (e.g., static_cast<uint64_t>) before making the size
