CWE-188 Reliance on Data/Memory Layout

The product makes invalid assumptions about how protocol data or memory is organized at a lower level.

• Integrity, Confidentiality: Modify Memory, Read Memory — This can result in unintended program behavior, including the unintended modifications or reading of sensitive memory. An implementation might access an unintended field in the protocol data/memory (such as a packet), treating data of one type as data of another type.

• [Implementation, Architecture and Design] In flat address space situations, never allow computing memory addresses as offsets from another memory address. • [Architecture and Design] Fully specify protocol layout unambiguously, providing a structured grammar (e.g., a compilable yacc grammar). • [Testing] Testing: Test that the implementation properly handles each case in the protocol grammar.

• Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues. • Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].