1794
Phase: Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might
not perform the initialization.
Phase: Implementation
Avoid race conditions (CWE-362) during initialization routines.
Phase: Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or
data.
Demonstrative Examples
Example 1:
Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed
once. However, the field is mistakenly set to true during static initialization, so the initialization code
is never reached.
Example Language: Java (Bad)
private boolean initialized = true;
public void someMethod() {
if (!initialized) {
// perform initialization tasks
...
initialized = true;
}
Example 2:
The following code intends to limit certain operations to the administrator only.
Example Language: Perl (Bad)
$username = GetCurrentUser();
$state = GetStateData($username);
if (defined($state)) {
$uid = ExtractUserID($state);
}
# do stuff
if ($uid == 0) {
DoAdminThings();
}
If the application is unable to extract the state information - say, due to a database timeout - then
the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as
equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even
if the attacker cannot directly influence the state data, unexpected errors could cause incorrect
privileges to be assigned to a user just by accident.
Example 3:
The following code intends to concatenate a string to a variable and print the string.
Example Language: C (Bad)
char str[20];
strcat(str, "hello world");
printf("%s", str);
CWE Version 4.14
CWE-908: Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource