目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-193 Off-by-one错误 类漏洞列表 93

CWE-193 Off-by-one错误 类弱点 93 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-193 属于边界计算错误，指软件在计算或使用时，最大值或最小值偏离正确值一个单位。攻击者常利用此缺陷触发缓冲区溢出或逻辑绕过，从而执行恶意代码或破坏系统完整性。开发者应避免此类问题，需严格验证边界条件，使用安全的数组访问函数，并在代码审查中重点关注循环终止条件和索引计算逻辑，确保数值处理精确无误。

MITRE CWE 官方描述
CWE：CWE-193 Off-by-one Error 英文：产品计算或使用了一个错误的最大值或最小值，该值比正确值大 1 或小 1。
常见影响 (3)
Availability DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Instability
This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.
Integrity Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality, Availability, Access Control Execute Unauthorized Code or Commands, Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
缓解措施 (1)
Implementation When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
代码示例 (2)
The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.
int i; unsigned int numWidgets; Widget **WidgetList; numWidgets = GetUntrustedSizeValue(); if ((numWidgets == 0) || (numWidgets > MAX_NUM_WIDGETS)) { ExitError("Incorrect number of widgets requested!"); } WidgetList = (Widget **)malloc(numWidgets * sizeof(Widget *)); printf("WidgetList ptr=%p\n", WidgetList); for(i=0; i<numWidgets; i++) { WidgetList[i] = InitializeWidget(); } WidgetList[numWidgets] = NULL; showWidgets(WidgetList);
Bad · C
In this example, the code does not account for the terminating null character, and it writes one byte beyond the end of the buffer.
char firstname[20]; char lastname[20]; char fullname[40]; fullname[0] = '\0'; strncat(fullname, firstname, 20); strncat(fullname, lastname, 20);
Bad · C
char firstname[20]; char lastname[20]; char fullname[40]; fullname[0] = '\0'; strncat(fullname, firstname, sizeof(fullname)-strlen(fullname)-1); strncat(fullname, lastname, sizeof(fullname)-strlen(fullname)-1);
Good · C
CVE ID 标题 CVSS 风险等级 Published
CVE-2019-8272 UltraVNC 安全漏洞 — UltraVNC 9.8 - 2019-03-09
CVE-2019-8268 UltraVNC 安全漏洞 — UltraVNC 9.8 - 2019-03-09
CVE-2017-2618 Linux kernel 安全漏洞 — kernel 5.5 - 2018-07-27

CWE-193（Off-by-one错误） 是常见的弱点类别，本平台收录该类弱点关联的 93 条 CVE 漏洞。