BNiehues931522 (Community Member) asked a question.
How to fix Improper Validation of Array Index in the bold lines? The line "c_mist = ir_buffer[loc_pos2];" is not marked as error!
for (unsigned int i=0;((i<mp_buffer_len) && ((mp_buffer_len - 1 - i)>=0) );++i) { /*R144612 BN210414 */
dbgsure(ir_length-1>=i*2 && z>0 && z-1>=i);
if ( ((mp_buffer_len-1)>=i) && (i>=0) && ((z-1-i)>=0) && ((mp_buffer_len-1-i)<mp_buffer_len) &&((ir_length-1-i*2)>=0) ) { /*R144612 Veracode BN210427 */
unsigned int loc_pos1 = (unsigned int)(mp_buffer_len-1-i); /*R144612 BN210308*/
unsigned int loc_pos2 = (unsigned int)(ir_length-1-i*2); /*R144612 BN210308*/
if ( (loc_pos1<mp_buffer_len) && (loc_pos1<=strlen(mp_buffer)) && (mp_buffer_len<INT_MAX) && (loc_pos2<=ir_length) ) { /*R144612 BN210427*/
char c_mist = mp_buffer[loc_pos1]; /*R144612 BN210311 */
c_mist = mp_buffer[mp_buffer_len-1]; /*R144612 BN210420 */
c_mist = ir_buffer[loc_pos2]; /*R144612 BN210311 */
mp_buffer[loc_pos1]=ir_buffer[loc_pos2];
E_this_system().get_local_OS().memcpy((byte *)(&mp_buffer[loc_pos1]),(const byte *)(&ir_buffer[loc_pos2]),1);
}
}
}
.png){kind=logo}
Hi @BNiehues931522,
Without more context to see how all of the variables in your sample code have been declared and set, it is difficult to make a determination why or why not CWE 129 flaws are identified in the locations you mentioned. Generally speaking, if you are confident that the checks you have in place are ensuring that each array index is always valid, you can propose a mitigation as described here in the Veracode Help Center documentation: https://help.veracode.com/r/improve_mitigation
If you would like to review the code more thoroughly, I would recommend scheduling a consultation call with a member of our Application Security Consulting team. You can schedule a consultation call by clicking on the icon in the upper-right hand corner and selecting “Contact Support”.
Best regards,
Michael Roberson