Off-by-One Detection
Detection Workflow
- Identify array operations: Find all array accesses, loop iterations, buffer allocations, string operations
- Analyze boundary conditions: Check loop termination conditions, array index ranges, buffer size calculations
- Check edge cases: Test boundary conditions, verify fencepost cases, assess null terminator handling
- Assess impact: Can off-by-one cause overflow/underflow? What's the security impact?
Key Patterns
- Loop bound errors: using <= instead of <, or < instead of <=
- Array index errors: accessing array[size] instead of array[size-1]
- String handling errors: missing null terminator, incorrect buffer size
- Allocation errors: allocating size instead of size+1
Output Format
Report with: id, type, subtype, severity, confidence, location, vulnerability, loop condition, array access, array size, error type, exploitability, attack scenario, impact, mitigation.
Severity Guidelines
- HIGH: Off-by-one causing buffer overflow
- MEDIUM: Off-by-one causing information disclosure
- LOW: Off-by-one with minor impact
See Also
patterns.md - Detailed detection patterns and exploitation scenariosexamples.md - Example analysis cases and code samplesreferences.md - CWE references and mitigation strategies
1---2name: detecting-off-by-one3description: Detects off-by-one errors by identifying incorrect loop conditions, array indexing mistakes, and boundary condition problems. Use when analyzing loops, array access, or investigating fencepost errors.4---5
6# Off-by-One Detection
7
8## Detection Workflow
9
101. **Identify array operations**: Find all array accesses, loop iterations, buffer allocations, string operations
112. **Analyze boundary conditions**: Check loop termination conditions, array index ranges, buffer size calculations
123. **Check edge cases**: Test boundary conditions, verify fencepost cases, assess null terminator handling
134. **Assess impact**: Can off-by-one cause overflow/underflow? What's the security impact?
14
15## Key Patterns
16
17- Loop bound errors: using <= instead of <, or < instead of <=
18- Array index errors: accessing array[size] instead of array[size-1]
19- String handling errors: missing null terminator, incorrect buffer size
20- Allocation errors: allocating size instead of size+1
21
22## Output Format
23
24Report with: id, type, subtype, severity, confidence, location, vulnerability, loop condition, array access, array size, error type, exploitability, attack scenario, impact, mitigation.
25
26## Severity Guidelines
27
28- **HIGH**: Off-by-one causing buffer overflow
29- **MEDIUM**: Off-by-one causing information disclosure
30- **LOW**: Off-by-one with minor impact
31
32## See Also
33
34- `patterns.md` - Detailed detection patterns and exploitation scenarios
35- `examples.md` - Example analysis cases and code samples
36- `references.md` - CWE references and mitigation strategies
majiayu000