1293
boolean isValidProduct = false;
boolean isValidAccount = false;
if (validProductNumber(productNumber)) {
isValidProduct = true;
updateInventory(productNumber);
}
else {
return;
}
if (validAccountNumber(accountNumber)) {
isValidProduct = true;
updateAccount(accountNumber, productNumber);
}
if (isValidProduct && isValidAccount) {
updateAccountOrder(accountNumber, productNumber);
}
}
However, the method never sets the isValidAccount variable after initializing it to false so the
isValidProduct is mistakenly used twice. The result is that the expression "isValidProduct &&
isValidAccount" will always evaluate to false, so the updateAccountOrder() method will never be
invoked. This will create serious problems with the product ordering application since the user
account and inventory databases will be updated but the order will not be updated.
This can be easily corrected by updating the appropriate variable.
Example Language: (Good)
...
if (validAccountNumber(accountNumber)) {
isValidAccount = true;
updateAccount(accountNumber, productNumber);
}
...
Example 2:
In the following example, the hasReadWriteAccess method uses bit masks and bit operators to
determine if a user has read and write privileges for a particular process. The variable mask is
defined as a bit mask from the BIT_READ and BIT_WRITE constants that have been defined. The
variable mask is used within the predicate of the hasReadWriteAccess method to determine if the
userMask input parameter has the read and write bits set.
Example Language: C (Bad)
#define BIT_READ 0x0001 // 00000001
#define BIT_WRITE 0x0010 // 00010000
unsigned int mask = BIT_READ & BIT_WRITE; /* intended to use "|" */
// using "&", mask = 00000000
// using "|", mask = 00010001
// determine if user has read and write access
int hasReadWriteAccess(unsigned int userMask) {
// if the userMask has read and write bits set
// then return 1 (true)
if (userMask & mask) {
return 1;
}
// otherwise return 0 (false)
return 0;
}
However the bit operator used to initialize the mask variable is the AND operator rather than the
intended OR operator (CWE-480), this resulted in the variable mask being set to 0. As a result, the
if statement will always evaluate to false and never get executed.
CWE Version 4.14
CWE-570: Expression is Always False
CWE-570: Expression is Always False