1477
In both of these examples, a message is printed based on the month passed into the function:
Example Language: Java (Bad)
public void printMessage(int month){
switch (month) {
case 1: print("January");
case 2: print("February");
case 3: print("March");
case 4: print("April");
case 5: print("May");
case 6: print("June");
case 7: print("July");
case 8: print("August");
case 9: print("September");
case 10: print("October");
case 11: print("November");
case 12: print("December");
}
println(" is a great month");
}
Example Language: C (Bad)
void printMessage(int month){
switch (month) {
case 1: printf("January");
case 2: printf("February");
case 3: printf("March");
case 4: printf("April");
case 5: printff("May");
case 6: printf("June");
case 7: printf("July");
case 8: printf("August");
case 9: printf("September");
case 10: printf("October");
case 11: printf("November");
case 12: printf("December");
}
printf(" is a great month");
}
Both examples do not use a break statement after each case, which leads to unintended
fall-through behavior. For example, calling "printMessage(10)" will result in the text
"OctoberNovemberDecember is a great month" being printed.
Example 4:
In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't
entered an email address in an HTML form.
Example Language: Java (Bad)
String email = request.getParameter("email_address");
assert email != null;
Observed Examples
Reference Description
CVE-2021-3011 virtual interrupt controller in a virtualization product allows crash of host by
writing a certain invalid value to a register, which triggers a fatal error instead
of returning an error code
https://www.cve.org/CVERecord?id=CVE-2021-3011
MemberOf Relationships
CWE Version 4.14
CWE-671: Lack of Administrator Control over Security
CWE-671: Lack of Administrator Control over Security