{"@ID": "237", "@Name": "Improper Handling of Structural Elements", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product does not handle or incorrectly handles inputs that are related to complex structures.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "228", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Common_Consequences": {"Consequence": {"Scope": "Integrity", "Impact": "Unexpected State"}}, "Demonstrative_Examples": {"Demonstrative_Example": {"@Demonstrative_Example_ID": "DX-91", "Intro_Text": "In the following C/C++ example, the method\n               processMessageFromSocket() will get a message from a\n               socket, save the message into a buffer, and place the\n               contents of the buffer into a structure that contains\n               the message length and the message body. Then a for\n               loop is used to copy the message body into a local\n               character string, which will be passed to another\n               method for processing.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:br": null, "xhtml:div": {"@style": "margin-left:1em;", "xhtml:i": ["// initialize variable to represent the failure case by default", "// get message from socket and store into buffer", "// for clarity of this example, ignore the possibility that buffer > BUFFER_SIZE"], "xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null, null, null, null], "xhtml:i": ["// place contents of the buffer into message structure", "// copy message body into string for processing", "// process message"], "xhtml:div": {"@style": "margin-left:1em;", "#text": "message[index] = msg->msgBody[index];"}, "#text": "ExMessage *msg = recastBuffer(buffer);\n                     \n                     \n                     int index;\n\t\t     for (index = 0; index < msg->msgLength; index++) {\n\t\t     \n\t\t     }\n\t\t     message[index] = '\\0';\n                     \n\t\t     success = processMessage(message);"}, "#text": "int success = -1;\n                   char buffer[BUFFER_SIZE];\n\t\t   char message[MESSAGE_SIZE];\n                   \n                   \n                   \n\t\t   if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {\n\t\t   \n\t\t   }\n\t\t   return success;"}, "#text": "int processMessageFromSocket(int socket) {\n\t\t \n\t\t }", "#text_blocks": ["int processMessageFromSocket(int socket) {", "// initialize variable to represent the failure case by default", "int success = -1;", "char buffer[BUFFER_SIZE];", "char message[MESSAGE_SIZE];", "// get message from socket and store into buffer", "// for clarity of this example, ignore the possibility that buffer > BUFFER_SIZE", "if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {", "// place contents of the buffer into message structure", "ExMessage *msg = recastBuffer(buffer);", "// copy message body into string for processing", "int index;", "for (index = 0; index < msg->msgLength; index++) {", "message[index] = msg->msgBody[index];", "}", "message[index] = '\\0';", "// process message", "success = processMessage(message);", "}", "return success;", "}"]}, "Body_Text": "However, the message length variable\n               (msgLength) from the structure is used as the condition\n               for ending the for loop without validating that\n               msgLength accurately reflects the actual length of the\n               message body (CWE-606). If msgLength indicates a length\n               that is longer than the size of a message body\n               (CWE-130), then this can result in a buffer over-read\n               by reading past the end of the buffer\n               (CWE-126)."}}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "PLOVER", "Entry_Name": "Element Problems"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated Description, Name"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-27", "Modification_Version": "2.0", "Modification_ReleaseDate": "2011-06-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-07-17", "Modification_Version": "2.5", "Modification_ReleaseDate": "2013-07-17", "Modification_Comment": "updated Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Time_of_Introduction, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Demonstrative_Examples"}], "Previous_Entry_Name": {"@Date": "2009-03-10", "#text": "Element Problems"}}, "entry_type": "Weakness"}