1512
Nature Type ID Name Page
ChildOf 628 Function Call with Incorrectly Specified Arguments 1398
Weakness Ordinalities
Primary :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : Perl (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Detection Methods
Other
While this weakness might be caught by the compiler in some languages, it can occur more
frequently in cases in which the called function accepts variable numbers of arguments, such
as format strings in C. It also can occur in loosely typed languages or environments. This might
require an understanding of intended program behavior or design to determine whether the value
is incorrect.
Potential Mitigations
Phase: Testing
Because this function call often produces incorrect behavior it will usually be detected during
testing or normal operation of the product. During testing exercise all possible control paths will
typically expose this weakness except in rare cases when the incorrect function call accidentally
produces the correct results or if the provided argument type is very similar to the expected
argument type.
Demonstrative Examples
Example 1:
In the following Java snippet, the accessGranted() method is accidentally called with the static
ADMIN_ROLES array rather than the user roles.
Example Language: Java (Bad)
private static final String[] ADMIN_ROLES = ...;
public boolean void accessGranted(String resource, String user) {
String[] userRoles = getUserRoles(user);
return accessGranted(resource, ADMIN_ROLES);
}
private boolean void accessGranted(String resource, String[] userRoles) {
// grant or deny access based on user roles
...
}
Observed Examples
Reference Description
CVE-2005-2548 Kernel code specifies the wrong variable in first argument, leading to resultant
NULL pointer dereference.
https://www.cve.org/CVERecord?id=CVE-2005-2548
MemberOf Relationships
CWE Version 4.14
CWE-689: Permission Race Condition During Resource Copy
CWE-689: Permission Race Condition During Resource Copy