609
Example Language: Java (Bad)
FileInputStream fis;
byte[] byteArray = new byte[1024];
for (Iterator i=users.iterator(); i.hasNext();) {
String userName = (String) i.next();
String pFileName = PFILE_ROOT + "/" + userName;
FileInputStream fis = new FileInputStream(pFileName);
fis.read(byteArray); // the file is always 1k bytes
fis.close();
processPFile(userName, byteArray);
The code loops through a set of users, reading a private data file for each user. The programmer
assumes that the files are always 1 kilobyte in size and therefore ignores the return value from
Read(). If an attacker can create a smaller file, the program will recycle the remainder of the data
from the previous user and treat it as though it belongs to the attacker.
Example 5:
The following code does not check to see if the string returned by getParameter() is null before
calling the member function compareTo(), potentially causing a NULL dereference.
Example Language: Java (Bad)
String itemName = request.getParameter(ITEM_NAME);
if (itemName.compareTo(IMPORTANT_ITEM) == 0) {
...
}
...
The following code does not check to see if the string returned by the Item property is null before
calling the member function Equals(), potentially causing a NULL dereference.
Example Language: Java (Bad)
String itemName = request.Item(ITEM_NAME);
if (itemName.Equals(IMPORTANT_ITEM)) {
...
}
...
The traditional defense of this coding error is: "I know the requested value will always exist
because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter
whether I handle the error or allow the program to die dereferencing a null value." But attackers are
skilled at finding unexpected paths through programs, particularly when exceptions are involved.
Example 6:
The following code shows a system property that is set to null and later dereferenced by a
programmer who mistakenly assumes it will always be defined.
Example Language: Java (Bad)
System.clearProperty("os.name");
...
String os = System.getProperty("os.name");
if (os.equalsIgnoreCase("Windows 95")) System.out.println("Not supported");
The traditional defense of this coding error is: "I know the requested value will always exist
because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter
whether I handle the error or allow the program to die dereferencing a null value." But attackers are
skilled at finding unexpected paths through programs, particularly when exceptions are involved.
Example 7:
CWE Version 4.14
CWE-252: Unchecked Return Value
CWE-252: Unchecked Return Value