Input Size and Quantity Bounds Enforcement
Description
Validation that user-supplied quantities — sizes, counts, lengths, offsets, indices, and repetition factors — fall within expected bounds before they are used in memory allocation, loop iteration, or buffer operations. Rejects values that are negative, zero when unexpected, or exceed a configured maximum. Applied at the protocol parsing layer before data reaches processing logic. This prevents integer overflow chains (where an oversized count wraps to a small value and bypasses bounds checks) and resource exhaustion attacks (where an unbounded count causes excessive allocation or iteration). The root cause control for vulnerabilities where the attacker controls a size or count field in a binary protocol, serialized format, or API parameter.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Malicious size or count values are rejected before reaching allocation or copy operations; the attacker must find a quantity field that bypasses validation or an alternative code path that does not enforce bounds |
| Availability (A) | H → L | Bounds enforcement rejects allocation and iteration requests that exceed configured maximums, preventing unbounded resource consumption from attacker-controlled size or count fields; low availability impact remains possible from repeated bounded-but-large operations within limits |
CWE Relationships
Verification
Verify that the application enforces maximum size limits on user-supplied quantity fields and rejects values outside expected ranges
# Expected: Safe integer arithmetic or size limit constants used before allocation operations
# Expected: Application-defined maximum bounds for user-supplied quantity fields
# Expected: Bounds checks on size/count/length variables before allocation or iteration