CWE-120 Buffer Overflow
What this means
SiteShadow flagged code where input could exceed the size of a fixed buffer (classic buffer overflow).
Why it matters
Buffer overflows can lead to crashes or code execution.
- RCE risk in native code paths.
- DoS via crashes when malformed inputs are processed.
Safer examples
1) Use bounds-checked operations
Prefer safe string/array APIs that require explicit sizes and check bounds.
2) Enforce input size limits early
Reject oversized inputs before parsing, decoding, or copying (see INPUT01/02, CWE-400).
3) Use fuzzing and sanitizers for native code
Fuzzers + ASan catch buffer overflows reliably during testing.
How SiteShadow detects it (high level)
- Flags unsafe copy patterns and missing bounds checks.
- Prioritizes parsing/decoding code fed by untrusted input.
References
- CWE-120: https://cwe.mitre.org/data/definitions/120.html
---