Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Incorrect rewind offset `(j - 1)` instead of `j` in partial string match failure can lead to undersized buffer allocation and subsequent heap buffer overflow.
Resetting loop variable '$I' to 0 immediately before 'continue' in an incrementing for-loop causes '$I' to increment to 1 on the next iteration, skipping index 0. Set '$I = -1' if the loop is intended to restart from index 0.
An improper bounds check was found where a required capacity upper limit is incorrectly increased by one (`> size + 1`). This off-by-one limit validation allows exactly one byte to be written or read out of bounds. Ensure limits bounds rely strictly on exact sizes, checking `offset + length > size`.
Fast bilinear scaling allows destination width equal to 8, which can lead to division by zero during chroma scale calculations. Ensure `dstW <= 8` is checked to fall back to standard bilinear.
A loop variable is initialized to 1 instead of 0 during a slice comparison. This skips the first element of the slice (index 0). If this function is used for security validation (e.g., evaluating privileges or rules), it could lead to policy bypasses. Ensure index 0 is validated, or initialize the loop variable to 0.
Using strict greater-than (>) instead of greater-than-or-equal (>=) against a collection length or count can allow an index exactly equal to the length to bypass validation, potentially leading to out-of-bounds accesses and panics.
A string is decoded into a dynamically allocated buffer that is restricted to the exact size of the input string length, but a null byte is unconditionally written at the end. This leads to an off-by-one heap buffer overflow if the input does not shrink during decoding. Ensure that the buffer allocation explicitly reserves space for the null terminator (e.g.
A loop reads from a pointer before performing bounds checking or checking remaining capacity, leading to potential out-of-bounds reads. Furthermore, using postfix decrement (`term-- < 0`) inside the loop causes off-by-one capacity failures, potentially leading to a one-byte buffer overflow (OOB write). Check limits before pointer dereference using a prefix d
The 'cells' structure member is allocated exactly to a defined maximum number of elements without padding. If index guards are off-by-one (as noted in FreeRDP CVE-2026-29775), this direct allocation enables heap out-of-bounds memory access. Ensure the element count is properly padded (e.g., + 1) to mitigate potential off-by-one access violations.
Bounds checking uses `>` instead of `>=` against width/height dimensions. This allows an off-by-one out-of-bounds access if the value equals the dimension size. Fix by using inclusive `>=` conditional bounds checking.
Detected an unconditional increment of an index/cursor after a boundary check and reset. This logic causes the cursor to go out of bounds before the check (off-by-one) and skips the 0th element after a reset. Ensure the increment happens in an `else` branch or fix the bounds logic.
