out-of-bounds · diff
git:20261016.fb3b156 to git:20261017.3e577be
11 added, 0 removed. Audit A to A.
---
name: out-of-bounds
description: Classify out-of-bounds read evidence — BUFFER_ACCESS events with array_oob_read/heap_oob_read categories. Maps to CWE-125.
license: MIT
compatibility: opencode,claude code,DSH
metadata:
cwe: CWE-125
severity: HIGH
domain: memory
---
## Out-of-Bounds Analysis (CWE-125)
### Evidence Pattern
An out-of-bounds candidate has:
- **BUFFER_ACCESS event** with category `array_oob_read` (fixed-size array read
past its declared size) or `heap_oob_read` (loop bound past a
`malloc`/`calloc` allocation)
- The subscript appears on the read side of an expression, e.g.
`secret = arr[i];` or `sum += buf[i];`
- **out_of_bounds**: the access site (function and line)
- **buffer**: the array being read (`array: <name> (capacity: N elements)` when
the declared size resolved)
- **index**: the access index expression
- **call_path**: the function is reachable from an entry point
+ ### Hint Tokens (Verdict Basis)
+
+ | Token | Meaning | Your action |
+ |-------|---------|-------------|
+ | `buf@<name>` | the array being read | the object of the OOB read |
+ | `cap@N` | the array's declared size in elements | compare `idx@` against this |
+ | `idx@<expr>` | the access index expression | CONSTANT: the detector already proved it reaches past `cap@` (machine-proved, confirm) |
+
+ This type only carries detector-proved reads, so a constant `idx@` past `cap@`
+ settles the row from the Hint alone — no evidence-file open needed.
+
### Typical Example
```c
int arr[10];
for (int i = 0; i <= 10; i++) { /* i == 10 is out of bounds */
secret = arr[i]; /* read past the array */
}
```
### Classification Rules
| Condition | Classification |
|-----------|---------------|
| Constant index (or a constant-valued variable `int n = 12; arr[n]`) >= array size, or loop bound provably overruns size | **confirmed** |
| Access guarded by a bounds check covering the read | **false-positive** |
| `sizeof(arr)` usage (not an element access) | **false-positive** |
An index that cannot be proven out-of-bounds (`buf[i]` with an unknown `i`) is
**not emitted at all** — the detector only reports OOB it can prove (constant
index past a known size, or a loop bound that provably overruns it).
### Fix Suggestions
- Change the loop to `i < arr_size` or `i <= arr_size - 1`
- Check the index against the allocation size before dereferencing
- Use `snprintf`-style sized APIs when reading from formatted buffers
### Severity Matrix
`status` and `severity` are independent: `status` = evidence verdict
(confirmed/dismissed), `severity` = impact (low/medium/high/critical).
`metadata.severity` is the type default, not a ceiling. The verdict is binary (confirmed/dismissed); dismissed → `low`.
| Shape | Severity |
|-------|----------|
| Provable OOB read of adjacent memory (info disclosure) | HIGH |
| OOB read leaking a sensitive adjacent buffer (secrets / canary) | CRITICAL |