Skip to main content

Out-of-bounds read

Need​

Prevention of out-of-bounds read vulnerabilities

Context​

  • Usage of C# for developing robust and scalable applications
  • No specific library or dependency used

Description​

Non compliant code​

public class VulnerableClass
{
    public byte[] Buffer { get; set; }

    public VulnerableClass()
    {
        Buffer = new byte[10];
    }

    public byte ReadBuffer(int index)
    {
        return Buffer[index];
    }
}

The above code defines a class VulnerableClass with a byte array Buffer of length 10 and a method ReadBuffer which takes an integer index as input and returns the byte at that index in the Buffer.

The vulnerability lies in the ReadBuffer method. It does not perform any bounds checking before accessing the Buffer array. This means if a user were to call ReadBuffer with an index that is less than 0 or greater than or equal to the length of the Buffer (10 in this case), the system would attempt to read data before or beyond the intended Buffer leading to an out-of-bounds read vulnerability. This could potentially lead to various issues including system crashes, data corruption, and exposure of sensitive information.

Steps​

  • Validate the input index value to ensure it is within the bounds of the buffer.
  • Use a conditional statement or exception handling to handle out-of-bounds index values.
  • Consider using a safer alternative to direct array indexing, such as using a collection class with bounds checking.
  • Implement proper input validation and sanitization to prevent malicious input from causing out-of-bounds reads.

Compliant code​

public class SafeClass
{
    public byte[] Buffer { get; set; }

    public SafeClass()
    {
        Buffer = new byte[10];
    }

    public byte? ReadBuffer(int index)
    {
        if (index >= 0 && index < Buffer.Length)
        {
            return Buffer[index];
        }
        else
        {
            // Handle out-of-bounds index values
            Console.WriteLine("Index out of bounds");
            return null;
        }
    }
}

The updated code introduces a safer way to read from the buffer. The ReadBuffer method now checks if the provided index is within the bounds of the buffer before attempting to read from it. This is done by checking if the index is greater than or equal to 0 and less than the length of the buffer.

If the index is within bounds, the method returns the byte at the specified index. If the index is out of bounds, the method writes an error message to the console and returns null. This prevents an out-of-bounds read, which could potentially lead to unexpected behavior or security vulnerabilities.

This solution also introduces the use of nullable byte (byte?) as the return type of the ReadBuffer method. This allows the method to return a null value when the index is out of bounds, providing another layer of safety.

Remember, it's always important to validate and sanitize input data, especially when it's used to access sensitive resources like memory buffers. This code provides a basic example of how to do this, but depending on the specifics of your application, you may need to implement additional checks or use more sophisticated methods for input validation and sanitization.

References​

Last updated on