3194 vulnerabilities classified as CWE-122 (堆缓冲区溢出). AI Chinese analysis included.
CWE-122 represents a critical memory safety weakness where an application writes data beyond the allocated boundaries of a heap-allocated buffer, typically created via functions like malloc. This vulnerability arises when developers fail to validate input lengths or perform insufficient bounds checking before copying data into dynamically allocated memory regions. Attackers exploit this flaw by crafting malicious inputs that exceed buffer limits, allowing them to overwrite adjacent heap metadata or control structures. Such overwrites can corrupt the heap manager’s internal state, leading to application crashes, data leakage, or arbitrary code execution by hijacking control flow. To prevent heap-based buffer overflows, developers must rigorously validate all input sizes against buffer capacities, utilize safe string handling libraries that enforce length limits, and employ modern memory-safe programming languages that automatically manage memory boundaries, thereby eliminating manual pointer arithmetic errors.
#define BUFSIZE 256 int main(int argc, char **argv) { char *buf; buf = (char *)malloc(sizeof(char)*BUFSIZE); strcpy(buf, argv[1]); }char * copy_input(char *user_supplied_string){ int i, dst_index; char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE); if ( MAX_SIZE <= strlen(user_supplied_string) ){ die("user string too long, die evil hacker!"); } dst_index = 0; for ( i = 0; i < strlen(user_supplied_string); i++ ){ if( '&' == user_supplied_string[i] ){ dst_buf[dst_index++] = '&'; dst_buf[dst_index++] = 'a'; dst_buf[dst_index++] = 'm'; dst_buf[dst_index++] = 'p'; dst_buf[dst_index++] = ';'; } else if ('<' == user_supplied_string[i] ){ /* encode to < */ } else dst_buf[dst_index++] = user_supplied_string[i]; } return dsVulnerabilities classified as CWE-122 (堆缓冲区溢出) represent 3194 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.