VOOZH about

URL: https://cwe.mitre.org/data/definitions/464.html

⇱ CWE - CWE-464: Addition of Data Structure Sentinel (4.20)

👁 CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities

👁 New to CWE? click here!
👁 CWE Most Important Hardware Weaknesses
👁 CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE-464: Addition of Data Structure Sentinel (4.20)  
CWE Glossary Definition
 👁 x

CWE-464: Addition of Data Structure Sentinel

Weakness ID: 464
Vulnerability Mapping: ALLOWED This CWE ID may be used to map to real-world vulnerabilities
Abstraction: Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
View customized information:
For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
×

Edit Custom Filter


👁 +
Description
The accidental addition of a data-structure sentinel can cause serious programming logic problems.
👁 +
Extended Description
Data-structure sentinels are often used to mark the structure of data. A common example of this is the null character at the end of strings or a special sentinel to mark the end of a linked list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the addition or modification of sentinels.
👁 +
Common Consequences
👁 Section Help
This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Impact Details

Modify Application Data

Scope: Integrity
Generally this error will cause the data structure to not work properly by truncating the data.
👁 +
Potential Mitigations
Phase(s) Mitigation

Implementation; Architecture and Design
Encapsulate the user from interacting with data sentinels. Validate user input to verify that sentinels are not present.

Implementation
Proper error checking can reduce the risk of inadvertently introducing sentinel values into data. For example, if a parsing function fails or encounters an error, it might return a value that is the same as the sentinel.

Architecture and Design
Use an abstraction library to abstract away risky APIs. This is not a complete solution.

Operation
Use OS-level preventative functionality. This is not a complete solution.
👁 +
 Relationships
👁 Section Help
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
👁 +
Relevant to the view "Research Concepts" (View-1000)
Nature Type ID Name
ChildOf 👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 		138 Improper Neutralization of Special Elements
PeerOf 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 		170 Improper Null Termination
PeerOf 👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 		463 Deletion of Data Structure Sentinel
👁 +
Relevant to the view "Software Development" (View-699)
Nature Type ID Name
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. 		137 Data Neutralization Issues
👁 +
Modes Of Introduction
👁 Section Help
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
Phase Note
Implementation
👁 +
Applicable Platforms
👁 Section Help
This listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
Languages

C (Undetermined Prevalence)

C++ (Undetermined Prevalence)

👁 +
Likelihood Of Exploit
High
👁 +
Demonstrative Examples

Example 1


The following example assigns some character values to a list of characters and prints them each individually, and then as a string. The third character value is intended to be an integer taken from user input and converted to an int. The first print statement will print each character separated by a space.

(bad code)
Example Language: C 
char *foo;
foo=malloc(sizeof(char)*5);
foo[0]='a';
foo[1]='a';
foo[2]=fgetc(stdin);
foo[3]='c';
foo[4]='\0';
printf("%c %c %c %c %c \n",foo[0],foo[1],foo[2],foo[3],foo[4]);
printf("%s\n",foo);

However, if a NULL byte is read from stdin by fgetc, then it will return 0. When foo is printed as a string, the 0 at character foo[2] will act as a NULL terminator, and the second printf() statement will not print foo[3].



👁 +
Weakness Ordinalities
Ordinality Description
Primary
(where the weakness exists independent of other weaknesses)
Resultant
(where the weakness is typically related to the presence of some other weaknesses)
👁 +
Memberships
👁 Section Help
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
Nature Type ID Name
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 741 CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 875 CERT C++ Secure Coding Section 07 - Characters and Strings (STR)
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 977 SFP Secondary Cluster: Design
MemberOf 👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic.		 1407 Comprehensive Categorization: Improper Neutralization
👁 +
Vulnerability Mapping Notes
Usage ALLOWED
(this CWE ID may be used to map to real-world vulnerabilities)
Reason Acceptable-Use

Rationale

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
👁 +
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Addition of data-structure sentinel
CERT C Secure Coding STR03-C Do not inadvertently truncate a null-terminated byte string
CERT C Secure Coding STR06-C Do not assume that strtok() leaves the parse string unchanged
👁 +
References
[REF-18] Secure Software, Inc.. "The CLASP Application Security Process". 2005.
<https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf>. (URL validated: 2024-11-17)
👁 +
Content History
👁 +
Submissions
Submission Date Submitter Organization
2006-07-19
(CWE Draft 3, 2006-07-19) 		CLASP
👁 +
Contributions
Contribution Date Contributor Organization
2024-07-20
(CWE 4.17, 2025-04-03) 		Jason Xu
Reported compilation error with demonstrative example.
👁 +
Modifications
Modification Date Modifier Organization
2025-12-11
(CWE 4.19, 2025-12-11) 		CWE Content Team MITRE
updated Demonstrative_Examples, Weakness_Ordinalities
2025-04-03
(CWE 4.17, 2025-04-03) 		CWE Content Team MITRE
updated Demonstrative_Examples
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Relationships, Time_of_Introduction
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated References, Relationships
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Demonstrative_Examples, Likelihood_of_Exploit, Taxonomy_Mappings
2014-07-30
(CWE 2.8, 2014-07-31) 		CWE Content Team MITRE
updated Relationships
2012-10-30
(CWE 2.3, 2012-10-30) 		CWE Content Team MITRE
updated Potential_Mitigations
2012-05-11
(CWE 2.2, 2012-05-15) 		CWE Content Team MITRE
updated Relationships
2011-09-13
(CWE 2.1, 2011-09-13) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2011-06-27
(CWE 2.0, 2011-06-27) 		CWE Content Team MITRE
updated Common_Consequences
2011-06-01
(CWE 1.13, 2011-06-01) 		CWE Content Team MITRE
updated Common_Consequences
2009-07-27
(CWE 1.5, 2009-07-27) 		CWE Content Team MITRE
updated Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships
2008-11-24
(CWE 1.1, 2008-11-25) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2008-09-08
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
2008-07-01
(CWE 1.0, 2008-09-09) 		Eric Dalci Cigital
updated Time_of_Introduction
👁 +
Previous Entry Names
Change Date Previous Entry Name
2008-04-11 Addition of Data-structure Sentinel
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated: April 30, 2026

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.