1800
printf("%s", test_string);
Another solution is to ensure that each branch of the conditional - including the default/else branch
- could ensure that test_string is set:
Example Language: C (Good)
char *test_string;
if (i != err_val)
{
test_string = "Hello World!";
}
else {
test_string = "Done on the other side!";
}
printf("%s", test_string);
Observed Examples
Reference Description
CVE-2020-20739 A variable that has its value set in a conditional statement is sometimes used
when the conditional fails, sometimes causing data leakage
https://www.cve.org/CVERecord?id=CVE-2020-20739
CVE-2005-1036 Chain: Bypass of access restrictions due to improper authorization (CWE-862)
of a user results from an improperly initialized (CWE-909) I/O permission
bitmap
https://www.cve.org/CVERecord?id=CVE-2005-1036
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE-910: Use of Expired File Descriptor
Weakness ID : 910
Structure : Simple
Abstraction : Base
Description
The product uses or accesses a file descriptor after it has been closed.
Extended Description
After a file descriptor for a particular file or device has been released, it can be reused. The code
might not write to the original file, since the reused file descriptor might reference a different file or
device.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-911: Improper Update of Reference Count
CWE-911: Improper Update of Reference Count