1510
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding FIO47-C Imprecise Use valid format strings
CERT C Secure Coding POS34-
C
Do not call putenv() with a pointer to an
automatic variable as the argument
CERT C Secure Coding STR37-C Arguments to character handling
functions must be representable as an
unsigned char
Software Fault Patterns SFP1 Glitch in computation
CWE-687: Function Call With Incorrectly Specified Argument Value
Weakness ID : 687
Structure : Simple
Abstraction : Variant
Description
The product calls a function, procedure, or routine, but the caller specifies an argument that
contains the wrong value, which may lead to resultant weaknesses.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 628 Function Call with Incorrectly Specified Arguments 1398
ParentOf 560 Use of umask() with chmod-style Argument 1274
Weakness Ordinalities
Primary :
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Detection Methods
Manual Static Analysis
This might require an understanding of intended program behavior or design to determine
whether the value is incorrect.
Demonstrative Examples
Example 1:
This Perl code intends to record whether a user authenticated successfully or not, and to exit if the
user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0
instead of 1, so it does not exit.
Example Language: Perl (Bad)
sub ReportAuth {
my ($username, $result, $fatal) = @_;
PrintLog("auth: username=%s, result=%d", $username, $result);
if (($result ne "success") && $fatal) {
die "Failed!\n";
CWE Version 4.14
CWE-688: Function Call With Incorrect Variable or Reference as Argument
CWE-688: Function Call With Incorrect Variable or Reference as Argument