1294
The use of bit masks, bit operators and bitwise operations on variables can be difficult. If
possible, try to use frameworks or libraries that provide appropriate functionality and abstract the
implementation.
Example 3:
In the following example, the updateInventory method used within an e-business inventory
application will update the inventory for a particular product. This method includes an if statement
with an expression that will always evaluate to false. This is a common practice in C/C++ to
introduce debugging statements quickly by simply changing the expression to evaluate to true and
then removing those debugging statements by changing expression to evaluate to false. This is
also a common practice for disabling features no longer needed.
Example Language: C (Bad)
int updateInventory(char* productNumber, int numberOfItems) {
int initCount = getProductCount(productNumber);
int updatedCount = initCount + numberOfItems;
int updated = updateProductCount(updatedCount);
// if statement for debugging purposes only
if (1 == 0) {
char productName[128];
productName = getProductName(productNumber);
printf("product %s initially has %d items in inventory \n", productName, initCount);
printf("adding %d items to inventory for %s \n", numberOfItems, productName);
if (updated == 0) {
printf("Inventory updated for product %s to %d items \n", productName, updatedCount);
}
else {
printf("Inventory not updated for product: %s \n", productName);
}
}
return updated;
}
Using this practice for introducing debugging statements or disabling features creates dead code
that can cause problems during code maintenance and potentially introduce vulnerabilities. To
avoid using expressions that evaluate to false for debugging purposes a logging API or debugging
API should be used for the output of debugging messages.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1307 CISQ Quality Measures - Maintainability 1305 2484
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding MSC00-
C
Compile cleanly at high warning levels
Software Fault Patterns SFP1 Glitch in computation
CWE Version 4.14
CWE-571: Expression is Always True
CWE-571: Expression is Always True