Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Pointer arithmetic calculates an offset backwards from the end of a buffer ($IV + $LEN - $OFFSET) without verifying that $LEN >= $OFFSET, potentially leading to buffer underflow or out-of-bounds access.
An integer subtraction is used for a slice allocation size without a prior bounds check. If the right-hand side of the subtraction is larger than the left-hand side, an unsigned integer underflow may occur, resulting in an exceptionally large allocation and potentially causing a Denial of Service (DoS) via an out-of-memory crash. Verify that the left-hand si
Remaining buffer capacity is calculated using `strlen(...)` instead of `sizeof(...)` or the buffer capacity. When the string length in the buffer equals the subtracted length, this subtraction underflows unsigned integers, bypassing subsequent bounds checks and causing buffer overflows.
Remaining buffer capacity is calculated using strlen() instead of sizeof(), which can cause an unsigned integer underflow when subtracting string lengths, leading to buffer overflow vulnerabilities.
Missing validation of padding length before subtracting from stream end pointer. This can lead to a pointer underflow and subsequent negative length calculation, resulting in a heap out-of-bounds read. Ensure that the padding is checked against the available buffer span before it is subtracted from the end pointer.
Subtracting an offset from a network-provided length without prior bounds checking can cause an integer underflow. If the length provided by an attacker is smaller than the offset, the result can wrap around to a large positive integer, resulting in out-of-bounds reads or writes.
Unchecked subtraction of `sizeof` from a length variable before a memory copy operation. This can lead to integer underflow if the length is smaller than the `sizeof` value, causing an out-of-bounds read/write when passed to `memcpy` or `memmove`. Always validate the length before subtraction.
An unsigned integer underflow can occur when directly subtracting a dynamically computed value from a bounding length variable without verification. If the right-hand side exceeds the value of the bounds, it wraps around to a large positive integer. In parsing loops, this may lead to infinite loops or out-of-bounds reads. Extract the computation to a variabl
Array access with `$LEN - 1` without proper bounds checking can lead to an integer underflow and memory corruption (OOB read/write) if `$LEN` is 0. Ensure that `$LEN` is adequately validated or bounded before deducting 1 to access the array.
Subtracting directly from an unwrapped and/or cast value can cause an integer underflow if the value is zero. `Option` types typically validate presence, not numerical bounds. Use `.saturating_sub()`, `.checked_sub()`, or explicitly check that the value is strictly greater than the subtrahend.
Unrestricted 'indent' parameter is multiplied by a nesting depth variable without bounds or sign checking. This can cause an integer overflow leading to a buffer overflow, or an underflow leading to an infinite loop. Ensure 'indent' is explicitly checked (e.g., `indent > 0`) before multiplication.
Detected an unsafe subtraction calculating multipart data length using `boundary.len + 8`. This calculation fails to align with the multipart buffer validation check that enforces a minimum length of `boundary.len + 6`. When the buffer length falls between these two values, it causes an integer underflow that generates a massive length parameter. This leads
An improper bounds check clamps a buffer size or length by subtracting the end index ($X) from the limit ($LIMIT) when $X > $LIMIT. This results in a negative value that, if cast to an unsigned size, causes an integer underflow and massive out-of-bounds reads or writes. To fix this, clamp by subtracting the start index from the limit (e.g., $LIMIT - $START).
Missing bounds check on WPS fragment length calculation can lead to integer underflow and memory corruption.
Unchecked subtraction of 1 from a size expression in a ternary operator can cause integer underflow or negative length values when size is 0, leading to out-of-bounds heap reads.
Advancing a pointer or offset directly by the return value of 'strlcpy' can cause buffer overflows or integer underflows. 'strlcpy' returns the full length of the source string rather than the number of bytes written. If the source string exceeds the destination buffer size, the pointer will advance past the allocated boundary.
Calculation `len(...) - offset - N` performed without verifying that slice length is sufficient. Malformed input could cause integer underflow and out-of-bounds slice access panics.
ISO Adaptation Layer lacks segment header length validation before subtracting time offset size, leading to an integer underflow and out-of-bounds read.
An unvalidated padding count is subtracted from a calculated length (often a pointer difference) and subsequently used as an array index or pointer offset. An attacker could provide an excessively large padding count causing integer underflow, yielding an out-of-bounds write (e.g., during null termination). Validate the padding count against expected maximum
A vulnerability exists where the `memcpy` size parameter is computed as `$W - $IX` after `$W` may have already been restricted to the remaining width. Subtracting `$IX` causes an underflow when cast to `size_t`, leading to a massive heap buffer over-read. Use the available dimension `$W` directly for the copy size.
Inadequate payload boundary check for EAP-MSCHAPv2 failure processing. The total message length is verified against 3 instead of accounting for the message header size. This causes an integer underflow when the header size is later subtracted off, enabling heap-based buffer overflows or out-of-bounds reads. Include the appropriate header length offset in the
A size_t parameter is decreased by a constant without checking if it is zero. Because size_t is unsigned, subtracting from zero causes it to underflow to a huge value (like SIZE_MAX). This can lead to severe buffer overflows if the resulting size is used in memory operations.
A bounds check uses a subtraction which can lead to integer underflow. If `$SIZE` is greater than `$LEN`, `$LEN - $SIZE` will wrap around to a large positive value (if unsigned), bypassing the length validation and causing an out-of-bounds read or write. Use addition instead (`$PTR + $SIZE <= $LEN`) or check the size against the remaining offset explicitly (
A subtraction expression is cast to `size_t` and used in a bounds check. If the subtraction yields a negative result, the cast to `size_t` will underflow to a large positive value, bypassing the intended bounds check. Instead of `(size_t)($Y - $Z)`, perform the arithmetic after casting or rearrange the comparison to use addition.
