1092
// authenticate user
public boolean authenticateUser(String username, String password) {
if (user == null) {
System.out.println("Cannot find user " + username);
}
else {
if (password.equals(user.getPassword())) {
isUserAuthentic = true;
}
}
return isUserAuthentic;
}
// methods for performing bank manager tasks
...
}
Example 5:
This example will leave test_string in an unknown condition when i is the same value as err_val,
because test_string is not initialized (CWE-456). Depending on where this code segment appears
(e.g. within a function body), test_string might be random if it is stored on the heap or stack. If
the variable is declared in static memory, it might be zero or NULL. Compiler optimization might
contribute to the unpredictability of this address.
Example Language: C (Bad)
char *test_string;
if (i != err_val)
{
test_string = "Hello World!";
}
printf("%s", test_string);
When the printf() is reached, test_string might be an unexpected address, so the printf might print
junk strings (CWE-457).
To fix this code, there are a couple approaches to making sure that test_string has been properly
set once it reaches the printf().
One solution would be to set test_string to an acceptable default before the conditional:
Example Language: C (Good)
char *test_string = "Done at the beginning";
if (i != err_val)
{
test_string = "Hello World!";
}
printf("%s", test_string);
Another solution is to ensure that each branch of the conditional - including the default/else branch
- could ensure that test_string is set:
Example Language: C (Good)
char *test_string;
if (i != err_val)
{
test_string = "Hello World!";
}
else {
test_string = "Done on the other side!";
}
printf("%s", test_string);
CWE Version 4.14
CWE-456: Missing Initialization of a Variable
CWE-456: Missing Initialization of a Variable