CWE-242 (使用内在危险函数) — Vulnerability Class 11

CWE-242 represents a critical design flaw where software invokes functions inherently incapable of safe execution, regardless of implementation context. These dangerous functions, often legacy constructs like gets(), lack essential security mechanisms such as bounds checking, making them vulnerable to buffer overflows. Attackers typically exploit this weakness by supplying arbitrarily sized input that exceeds the allocated memory buffer, allowing them to overwrite adjacent memory structures. This manipulation can lead to arbitrary code execution, denial of service, or data corruption. To mitigate this risk, developers must strictly avoid using such deprecated functions entirely. Instead, they should adopt modern, secure alternatives that enforce rigorous input validation and memory management, ensuring that all data operations remain within defined boundaries and preventing the exploitation of inherent functional deficiencies.