T09 · Insecure Skill Coding Practices
Error
- Location
code.c:27- Finding
Out-of-Bounds Frequency-Table Access for Non-Lowercase Input
- Content
View full analysis
0) { double p = (double)freq[i] / 10000; entropy -= p * log2(p); } } double max_entropy = log2(ALPHABET_SIZE); return 1.0 - (entropy / max_entropy); } int find_rarest_char_pos(const char *pattern, int m, const int *text_freq) { int rarest_pos = 0; int min_freq = text_freq[pattern[0] - 'a']; for (int i = 1; i < m; i++) { int freq = text_freq[pattern[i] - 'a']; if (freq < min_freq) { min_freq = freq; rarest_pos = i; } } return rarest_pos; } ``` The same unsafe indexing occurs while sampling text in the adaptive search: ```c int text_freq[ALPHABET_SIZE] = {0}; for (int i = 0; i < sample_size; i++) { text_freq[text[i] - 'a']++; } ``` ### Technical Analysis `ALPHABET_SIZE` is 26, but text and pattern bytes are converted directly into indices by subtracting `'a'`. The code does not establish that each byte falls within the inclusive range `'a'` through `'z'`. For example, an uppercase `A`, punctuation, a null byte, or a byte whose `char` representation is negative can produce an index below zero or above 25. The resulting operations access memory outside the `freq` or `text_freq` arrays. The writes in `calculate_redundancy()` and `yijing_v3_search()` can corrupt stack memory, while the accesses in `find_rarest_char_pos()` can read outside the frequency table. The documentation describes general text processing and log analysis, so callers could rea ...[truncated 1091 chars]- Remediation
View remediation