CWE-120 (未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)) — Vulnerability Class 1889

CWE-120 represents a critical memory safety vulnerability where software copies data into a fixed-size buffer without validating the input’s length against the destination’s capacity. This classic buffer overflow occurs when an attacker supplies input exceeding the allocated memory space, causing data to spill into adjacent memory regions. Exploitation typically involves injecting malicious code or altering program control flow, such as overwriting return addresses to execute arbitrary commands. Developers prevent this weakness by implementing rigorous bounds checking before any copy operation, ensuring the input size never exceeds the buffer’s limits. Utilizing safer, language-specific functions that automatically handle size verification, or adopting modern programming languages with built-in memory safety features, effectively mitigates this risk and preserves application integrity against memory corruption attacks.