1575
In the following Java example the method readFromFile uses a FileReader object to read the
contents of a file. The FileReader object is created using the File object readFile, the readFile
object is initialized using the setInputFile method. The setInputFile method should be called before
calling the readFromFile method.
Example Language: Java (Bad)
private File readFile = null;
public void setInputFile(String inputFile) {
// create readFile File object from string containing name of file
}
public void readFromFile() {
try {
reader = new FileReader(readFile);
// read input file
} catch (FileNotFoundException ex) {...}
}
However, the readFromFile method does not check to see if the readFile object is null, i.e. has
not been initialized, before creating the FileReader object and reading from the input file. The
readFromFile method should verify whether the readFile object is null and output an error message
and raise an exception if the readFile object is null, as in the following code.
Example Language: Java (Good)
private File readFile = null;
public void setInputFile(String inputFile) {
// create readFile File object from string containing name of file
}
public void readFromFile() {
try {
if (readFile == null) {
System.err.println("Input file has not been set, call setInputFile method before calling openInputFile");
throw NullPointerException;
}
reader = new FileReader(readFile);
// read input file
} catch (FileNotFoundException ex) {...}
catch (NullPointerException ex) {...}
}
Observed Examples
Reference Description
CVE-2023-49286 Chain: function in web caching proxy does not correctly check a return value
(CWE-253) leading to a reachable assertion (CWE-617)
https://www.cve.org/CVERecord?id=CVE-2023-49286
CVE-2007-3798 Unchecked return value leads to resultant integer overflow and code
execution.
https://www.cve.org/CVERecord?id=CVE-2007-3798
CVE-2006-4447 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-4447
CVE-2006-2916 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-2916
MemberOf Relationships
CWE Version 4.14
CWE-755: Improper Handling of Exceptional Conditions
CWE-755: Improper Handling of Exceptional Conditions