Description

Identifies unsafe usage of Marshal.Copy in C# that could lead to buffer overflows when copying data between managed and unmanaged memory. Buffer overflows can allow attackers to corrupt memory and potentially execute arbitrary code.

Detection Strategy

• Checks if the System.Runtime.InteropServices namespace is imported in the code

• Looks for calls to Marshal.Copy method

• Verifies if the Marshal.Copy call uses unsafe arguments that could lead to buffer overflow

• Reports vulnerability when Marshal.Copy is called with parameters that don't ensure safe buffer boundaries

Vulnerable code example

using System;
using System.Runtime.InteropServices;

public class UnsafeBufferExample
{
    public void ProcessBuffer(string lengthInput)
    {
        byte[] buffer = new byte[10];...

✅ Secure code example

using System;
using System.Runtime.InteropServices;

public class SafeBufferExample
{
    private const int BUFFER_SIZE = 10;
    
    public void ProcessBuffer(string lengthInput)...