1578
out.println("hello " + addr.getHostName());
}
A DNS lookup failure will cause the Servlet to throw an exception.
Example 2:
The following example attempts to allocate memory for a character. After the call to malloc, an if
statement is used to check whether the malloc function failed.
Example Language: C (Bad)
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
//We do nothing so we just ignore the error.
}
The conditional successfully detects a NULL return value from malloc indicating a failure, however
it does not do anything to handle the problem. Unhandled errors may have unexpected results and
may cause the program to crash or terminate.
Instead, the if block should contain statements that either attempt to fix the problem or notify the
user that an error has occurred and continue processing or perform some cleanup and gracefully
terminate the program. The following example notifies the user that the malloc function did not
allocate the required memory resources and returns an error code.
Example Language: C (Good)
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
printf("Malloc failed to allocate memory resources");
return -1;
}
Example 3:
The following code mistakenly catches a NullPointerException.
Example Language: Java (Bad)
try {
mysteryMethod();
} catch (NullPointerException npe) {
}
Observed Examples
Reference Description
CVE-2023-41151 SDK for OPC Unified Architecture (OPC UA) server has uncaught exception
when a socket is blocked for writing but the server tries to send an error
https://www.cve.org/CVERecord?id=CVE-2023-41151
[REF-1374] Chain: JavaScript-based cryptocurrency library can fall back to the insecure
Math.random() function instead of reporting a failure (CWE-392), thus reducing
the entropy (CWE-332) and leading to generation of non-unique cryptographic
keys for Bitcoin wallets (CWE-1391)
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards
CVE-2021-3011 virtual interrupt controller in a virtualization product allows crash of host by
writing a certain invalid value to a register, which triggers a fatal error instead
of returning an error code
https://www.cve.org/CVERecord?id=CVE-2021-3011
CWE Version 4.14
CWE-756: Missing Custom Error Page
CWE-756: Missing Custom Error Page