CWE-467 Use of sizeof() on a Pointer Type

The code calls sizeof() on a pointer type, when the programmer intended to determine the size of the data that is being pointed to.

• Integrity, Confidentiality: Modify Memory, Read Memory — This error can often cause one to allocate a buffer that is much smaller than what is needed, leading to resultant weaknesses such as buffer overflows.

• [Implementation] Use expressions such as "sizeof(*pointer)" instead of "sizeof(pointer)", unless you intend to run sizeof() on a pointer type to gain some platform independence or if you are allocating a variable on the stack.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2025-33132: Database utility uses sizeof() on a pointer type, leading to incorrect size calculation and a crash.