Rule Explorer

Allocator call receives an unchecked `$N * sizeof($T)` byte count. If `$N` is large (e.g., attacker-controlled, derived from a model/file field), the multiplication can wrap `size_t` and the allocator will return an under-sized buffer while the caller still indexes up to `$N` elements, causing a heap buffer overflow (CWE-680, CVE-2025-54952). Guard the multi

C++CVE-2025-54952CWE-680

An integer truncation occurs when a 64-bit array element is assigned to a 32-bit integer. When this truncated value is subsequently used in a function call (such as a memory allocation size), it can result in allocating an undersized buffer, leading to an overflow. Ensure the variable is of an adequate type (e.g., `uint64_t`) and implement bounds checking on

CCVE-2024-46952CWE-197CWE-680