Illegal Pointer Value

Some functions can return a pointer to memory outside the bounds of the buffer to be searched. Subsequent operations on the pointer could have unintended consequences.

Functions that search for characters within a buffer can return a pointer outside the bounds of the buffer provided under either of the following circumstances:

- A user controls the contents of the buffer to be searched.

- A user controls the value for which to search.

Example 1: The following short program uses an untrusted command-line argument as the search buffer in a call to rawmemchr().

int main(int argc, char** argv) {
  char* ret = rawmemchr(argv[0], 'x');
  printf("%s\n", ret);
}

The program is meant to print a substring of argv[0], but it might end up printing some portion of memory located above argv[0].

This issue is similar to a string termination error, where the programmer relies on a character array to contain a null-terminator.