Description

The software reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Extended Description

This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.

Applicable Platforms
None

Common Consequences

Detection Methods
None

Potential Mitigations
None

Relationships

Demonstrative Examples   (Details)

1. In the following C/C++ example, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character. (Demonstrative Example Id DX-87)
2. The following example asks a user for an offset into an array to select an item. (Demonstrative Example Id DX-90)
3. The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf: (Demonstrative Example Id DX-88)

Observed Examples

1. CVE-2002-2227 : Unchecked length of SSLv2 challenge value leads to buffer underflow.
2. CVE-2007-4580 : Buffer underflow from a small size value with a large buffer (length parameter inconsistency, CWE-130)
3. CVE-2007-1584 : Buffer underflow from an all-whitespace string, which causes a counter to be decremented before the buffer while looking for a non-whitespace character.
4. CVE-2007-0886 : Buffer underflow resultant from encoded data that triggers an integer overflow.
5. CVE-2006-6171 : Product sets an incorrect buffer size limit, leading to "off-by-two" buffer underflow.
6. CVE-2006-4024 : Negative value is used in a memcpy() operation, leading to buffer underflow.
7. CVE-2004-2620 : Buffer underflow due to mishandled special characters

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:
None