1296
Example Language: Java (Bad)
public void updateInventory(String productNumber) {
boolean isProductAvailable = false;
boolean isDelayed = false;
if (productInStore(productNumber)) {
isProductAvailable = true;
updateInStoreDatabase(productNumber);
}
else if (productInWarehouse(productNumber)) {
isProductAvailable = true;
updateInWarehouseDatabase(productNumber);
}
else {
isProductAvailable = true;
}
if ( isProductAvailable ) {
updateProductDatabase(productNumber);
}
else if ( isDelayed ) {
/* Warn customer about delay before order processing */
...
}
}
However, the method never sets the isDelayed variable and instead will always update the
isProductAvailable variable to true. The result is that the predicate testing the isProductAvailable
boolean will always evaluate to true and therefore always update the product database. Further,
since the isDelayed variable is initialized to false and never changed, the expression always
evaluates to false and the customer will never be warned of a delay on their product.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1307 CISQ Quality Measures - Maintainability 1305 2484
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding MSC00-
C
Compile cleanly at high warning levels
Software Fault Patterns SFP1 Glitch in computation
CWE-572: Call to Thread run() instead of start()
Weakness ID : 572
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-572: Call to Thread run() instead of start()
CWE-572: Call to Thread run() instead of start()