An out-of-bounds read occurs when a program accesses memory outside the allocated boundaries of a buffer or array. This can expose sensitive data stored in…
An out-of-bounds read occurs when a program accesses memory outside the allocated boundaries of a buffer or array. This can expose sensitive data stored in adjacent memory, cause the application to crash, or provide information an attacker can use to bypass security protections. Unlike out-of-bounds *writes*, which corrupt data, reads silently leak whatever happens to be in that memory location.
Out-of-bounds reads typically arise when a program uses an index or pointer to access array or buffer data without properly validating that the index falls within the allocated range. Common causes include:
- Missing bounds checks:
Code assumes an index is valid without verifying it against the buffer size.
- Off-by-one errors:
Loop conditions or pointer arithmetic miscalculate the valid range by one position.
- Incorrect length calculations:
A function receives a size parameter that doesn't match the actual buffer size, or the size is computed incorrectly.
- Unsafe string operations:
Functions like strcpy() or sprintf() that don't enforce length limits, or manual string parsing that doesn't account for null terminators.
- Type confusion:
Interpreting a buffer as a different data type with a larger element size, causing reads beyond the intended boundary.
An attacker or buggy code path can read sensitive data from adjacent memory regions—encryption keys, authentication tokens, other users' data, or internal pointers—and either crash the application or leak that information. In some cases, repeated reads of predictable memory patterns can help an attacker defeat address-space layout randomization (ASLR) or other protections. The severity depends on what data is nearby and whether the leak is observable to an attacker.
def read_user_field(data, index):
# No bounds check on index
fields = data.split(',')
return fields[index]
user_data = "alice,admin,secret_key"
print(read_user_field(user_data, 10)) # IndexError, but in C this reads past bufferWhy it's vulnerable:
The function does not verify that index is within the valid range of fields. In Python, this raises an exception; in C or C++, it silently reads adjacent memory.
def read_user_field(data, index):
fields = data.split(',')
if index < 0 or index >= len(fields):
raise ValueError("Index out of bounds")
return fields[index]
user_data = "alice,admin,secret_key"
print(read_user_field(user_data, 1)) # Returns "admin"function read_config_value($config_array, $key_index) {
// No bounds check; assumes $key_index is valid
$keys = array_keys($config_array);
return $keys[$key_index];
}
$config = ['db_host' => 'localhost', 'db_pass' => 'secret'];
echo read_config_value($config, 99); // Undefined offset warning, returns NULLWhy it's vulnerable:
The function accesses an array element without verifying the index exists. In lower-level languages, this reads uninitialized or adjacent memory.
function read_config_value($config_array, $key_index) {
$keys = array_keys($config_array);
if ($key_index < 0 || $key_index >= count($keys)) {
throw new OutOfBoundsException("Invalid key index");
}
return $keys[$key_index];
}
$config = ['db_host' => 'localhost', 'db_pass' => 'secret'];
echo read_config_value($config, 1); // Returns 'db_pass'strncpy(), snprintf(), parameterized queries) instead of unbounded variants.
- Unexpected crashes or segmentation faults in production, particularly when processing unusual or large inputs. - Security tools or crash reports flagging "out-of-bounds read" or "heap buffer overflow" (read variant). - Intermittent behavior or data corruption that correlates with specific input patterns or memory pressure.
