CWE-588 Attempt to Access Child of a Non-structure Pointer

The product casts a non-structure type to a structure type, then accesses a field within the structure.

• Integrity: Modify Memory — Adjacent variables in memory may be corrupted by assignments performed on fields after the cast, leading to data corruption. • Availability: DoS: Crash, Exit, or Restart — Execution may end due to a memory access error.

• [Requirements] The choice could be made to use a language that is not susceptible to these issues. • [Implementation] Review of type casting operations can identify locations where incompatible types are cast.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2021-3510: JSON decoder accesses a C union using an invalid offset to an object