1613
Demonstrative Examples
Example 1:
The following function attempts to take a size value from a user and allocate an array of that size
(we ignore bounds checking for simplicity). The function tries to initialize each spot with the value
of its index, that is, A[len-1] = len - 1; A[len-2] = len - 2; ... A[1] = 1; A[0] = 0; However, since the
programmer uses the prefix decrement operator, when the conditional is evaluated with i == 1, the
decrement will result in a 0 value for the first part of the predicate, causing the second portion to be
bypassed via short-circuit evaluation. This means we cannot be sure of what value will be in A[0]
when we return the array to the user.
Example Language: C (Bad)
#define PRIV_ADMIN 0
#define PRIV_REGULAR 1
typedef struct{
int privileges;
int id;
} user_t;
user_t *Add_Regular_Users(int num_users){
user_t* users = (user_t*)calloc(num_users, sizeof(user_t));
int i = num_users;
while( --i && (users[i].privileges = PRIV_REGULAR) ){
users[i].id = i;
}
return users;
}
int main(){
user_t* test;
int i;
test = Add_Regular_Users(25);
for(i = 0; i < 25; i++) printf("user %d has privilege level %d\n", test[i].id, test[i].privileges);
}
When compiled and run, the above code will output a privilege level of 1, or PRIV_REGULAR for
every user but the user with id 0 since the prefix increment operator used in the if statement will
reach zero and short circuit before setting the 0th user's privilege level. Since we used calloc, this
privilege will be set to 0, or PRIV_ADMIN.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 871 CERT C++ Secure Coding Section 03 - Expressions
(EXP)
868 2374
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to protect stored data from
modification
Software Fault Patterns SFP1 Glitch in computation
CWE-770: Allocation of Resources Without Limits or Throttling
CWE Version 4.14
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-770: Allocation of Resources Without Limits or Throttling