1459
initialize a variable, then the code could produce a compile-time error (if the variable is local) or
automatically initialize the variable to the default value for the variable's type. In Perl, if explicit
initialization is not performed, then a default value of undef is assigned, which is interpreted as 0,
false, or an equivalent value depending on the context in which the variable is accessed.
Phase: Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply
input validation to make sure that they are only initialized to expected values.
Phase: Implementation
Explicitly initialize all your variables and other data stores, either during declaration or just before
the first usage.
Phase: Implementation
Pay close attention to complex conditionals that affect initialization, since some conditions might
not perform the initialization.
Phase: Implementation
Avoid race conditions (CWE-362) during initialization routines.
Phase: Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or
data.
Phase: Testing
Use automated static analysis tools that target this type of weakness. Many modern techniques
use data flow analysis to minimize the number of false positives. This is not a perfect solution,
since 100% accuracy and coverage are not feasible.
Demonstrative Examples
Example 1:
Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed
once. However, the field is mistakenly set to true during static initialization, so the initialization code
is never reached.
Example Language: Java (Bad)
private boolean initialized = true;
public void someMethod() {
if (!initialized) {
// perform initialization tasks
...
initialized = true;
}
Example 2:
The following code intends to limit certain operations to the administrator only.
Example Language: Perl (Bad)
$username = GetCurrentUser();
$state = GetStateData($username);
if (defined($state)) {
$uid = ExtractUserID($state);
}
# do stuff
if ($uid == 0) {
DoAdminThings();
}
CWE Version 4.14
CWE-665: Improper Initialization
CWE-665: Improper Initialization