CWE-135
Incorrect Calculation of Multi-Byte String Length
AI Translation Available
The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
Status
draft
Abstraction
base
Affected Platforms
C
C++
Technical Details
AI Translation
Common Consequences
integrity
confidentiality
availability
Impacts
execute unauthorized code or commands
read memory
dos: crash, exit, or restart
dos: resource consumption (cpu)
dos: resource consumption (memory)
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Always verify the length of the string unit character.
•
Use length computing functions (e.g. strlen, wcslen, etc.) appropriately with their equivalent type (e.g.: byte, wchar_t, etc.)