1277
s = "Yes";
return;
}
if (s != null) {
Dead();
}
Example 2:
In the following class, two private methods call each other, but since neither one is ever invoked
from anywhere else, they are both dead code.
Example Language: Java (Bad)
public class DoubleDead {
private void doTweedledee() {
doTweedledumb();
}
private void doTweedledumb() {
doTweedledee();
}
public static void main(String[] args) {
System.out.println("running DoubleDead");
}
}
(In this case it is a good thing that the methods are dead: invoking either one would cause an
infinite loop.)
Example 3:
The field named glue is not used in the following class. The author of the class has accidentally put
quotes around the field name, transforming it into a string constant.
Example Language: Java (Bad)
public class Dead {
String glue;
public String getGlue() {
return "glue";
}
}
Observed Examples
Reference Description
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
CWE Version 4.14
CWE-562: Return of Stack Variable Address
CWE-562: Return of Stack Variable Address