1466
}
fclose($logFile);
PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the
file lock, this code will pause execution, possibly leading to denial of service for other users. Note
that in this case, if an attacker can perform an flock() on the file, they may already have privileges
to destroy the log file. However, this still impacts the execution of other programs that depend on
flock().
Example 3:
The following function attempts to acquire a lock in order to perform operations on a shared
resource.
Example Language: C (Bad)
void f(pthread_mutex_t *mutex) {
pthread_mutex_lock(mutex);
/* access shared resource */
pthread_mutex_unlock(mutex);
}
However, the code does not check the value returned by pthread_mutex_lock() for errors. If
pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race
condition into the program and result in undefined behavior.
In order to avoid data races, correctly written programs must check the result of thread
synchronization functions and appropriately handle all errors, either by attempting to recover from
them or reporting them to higher levels.
Example Language: C (Good)
int f(pthread_mutex_t *mutex) {
int result;
result = pthread_mutex_lock(mutex);
if (0 != result)
return result;
/* access shared resource */
return pthread_mutex_unlock(mutex);
}
Example 4:
It may seem that the following bit of code achieves thread safety while avoiding unnecessary
synchronization...
Example Language: Java (Bad)
if (helper == null) {
synchronized (this) {
if (helper == null) {
helper = new Helper();
}
}
}
return helper;
The programmer wants to guarantee that only one Helper() object is ever allocated, but does not
want to pay the cost of synchronization every time this code is called.
Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the
synchronized block and begins to execute:
CWE Version 4.14
CWE-667: Improper Locking
CWE-667: Improper Locking