1573
...
The following code does not check to see if the string returned by the Item property is null before
calling the member function Equals(), potentially causing a NULL dereference.
Example Language: Java (Bad)
String itemName = request.Item(ITEM_NAME);
if (itemName.Equals(IMPORTANT_ITEM)) {
...
}
...
The traditional defense of this coding error is: "I know the requested value will always exist
because.... If it does not exist, the program cannot perform the desired behavior so it doesn't
matter whether I handle the error or simply allow the program to die dereferencing a null value." But
attackers are skilled at finding unexpected paths through programs, particularly when exceptions
are involved.
Example 5:
The following code shows a system property that is set to null and later dereferenced by a
programmer who mistakenly assumes it will always be defined.
Example Language: Java (Bad)
System.clearProperty("os.name");
...
String os = System.getProperty("os.name");
if (os.equalsIgnoreCase("Windows 95")) System.out.println("Not supported");
The traditional defense of this coding error is: "I know the requested value will always exist
because.... If it does not exist, the program cannot perform the desired behavior so it doesn't
matter whether I handle the error or simply allow the program to die dereferencing a null value." But
attackers are skilled at finding unexpected paths through programs, particularly when exceptions
are involved.
Example 6:
The following VB.NET code does not check to make sure that it has read 50 bytes from myfile.txt.
This can cause DoDangerousOperation() to operate on an unexpected value.
Example Language: C# (Bad)
Dim MyFile As New FileStream("myfile.txt", FileMode.Open, FileAccess.Read, FileShare.Read)
Dim MyArray(50) As Byte
MyFile.Read(MyArray, 0, 50)
DoDangerousOperation(MyArray(20))
In .NET, it is not uncommon for programmers to misunderstand Read() and related methods
that are part of many System.IO classes. The stream and reader classes do not consider it to be
unusual or exceptional if only a small amount of data becomes available. These classes simply add
the small amount of data to the return buffer, and set the return value to the number of bytes or
characters read. There is no guarantee that the amount of data returned is equal to the amount of
data requested.
Example 7:
This example takes an IP address from a user, verifies that it is well formed and then looks up the
hostname and copies it into a buffer.
CWE Version 4.14
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754: Improper Check for Unusual or Exceptional Conditions