1612
Mapped Taxonomy Name Node ID Fit Mapped Node Name
SEI CERT Perl Coding
Standard
OOP31-
PL
Imprecise Do not access private variables or
subroutines in other packages
CWE-768: Incorrect Short Circuit Evaluation
Weakness ID : 768
Structure : Simple
Abstraction : Variant
Description
The product contains a conditional statement with multiple logical expressions in which one of the
non-leading expressions may produce side effects. This may lead to an unexpected state in the
program after the execution of the conditional, because short-circuiting logic may prevent the side
effects from occurring.
Extended Description
Usage of short circuit evaluation, though well-defined in the C standard, may alter control flow in a
way that introduces logic errors that are difficult to detect, possibly causing errors later during the
product's execution. If an attacker can discover such an inconsistency, it may be exploitable to gain
arbitrary control over a system.
If the first condition of an "or" statement is assumed to be true under normal circumstances, or if
the first condition of an "and" statement is assumed to be false, then any subsequent conditional
may contain its own logic errors that are not detected during code review or testing.
Finally, the usage of short circuit evaluation may decrease the maintainability of the code.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 691 Insufficient Control Flow Management 1517
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Varies by Context
Widely varied consequences are possible if an attacker
is aware of an unexpected state in the product after a
conditional. It may lead to information exposure, a system
crash, or even complete attacker control of the system.
Potential Mitigations
Phase: Implementation
Minimizing the number of statements in a conditional that produce side effects will help to
prevent the likelihood of short circuit evaluation to alter control flow in an unexpected way.
CWE Version 4.14
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-770: Allocation of Resources Without Limits or Throttling