1256
Demonstrative Examples
Example 1:
This method is part of a singleton pattern, yet the following singleton() pattern is not thread-safe. It
is possible that the method will create two objects instead of only one.
Example Language: Java (Bad)
private static NumberConverter singleton;
public static NumberConverter get_singleton() {
if (singleton == null) {
singleton = new NumberConverter();
}
return singleton;
}
Consider the following course of events:
• Thread A enters the method, finds singleton to be null, begins the NumberConverter
constructor, and then is swapped out of execution.
• Thread B enters the method and finds that singleton remains null. This will happen if A was
swapped out during the middle of the constructor, because the object reference is not set to
point at the new object on the heap until the object is fully initialized.
• Thread B continues and constructs another NumberConverter object and returns it while
exiting the method.
• Thread A continues, finishes constructing its NumberConverter object, and returns its version.
At this point, the threads have created and returned two different objects.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 861 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 18 - Miscellaneous (MSC)
844 2370
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC07-J Prevent multiple instantiations of
singleton objects
Software Fault Patterns SFP19 Missing Lock
References
[REF-474]Douglas C. Schmidt, Timothy H. Harrison and Nat Pryce. "Thread-Specifc Storage for C/
C++". < http://www.cs.wustl.edu/~schmidt/PDF/TSS-pattern.pdf >.
CWE-544: Missing Standardized Error Handling Mechanism
Weakness ID : 544
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-544: Missing Standardized Error Handling Mechanism
CWE-544: Missing Standardized Error Handling Mechanism