1364
The programmer wants to guarantee that only one Helper() object is ever allocated, but does not
want to pay the cost of synchronization every time this code is called.
Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the
synchronized block and begins to execute:
Example Language: (Bad)
helper = new Helper();
If a second thread, thread B, takes over in the middle of this call and helper has not finished
running the constructor, then thread B may make calls on helper while its fields hold incorrect
values.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 853 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 10 - Locking (LCK)
844 2366
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1143 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 09. Locking (LCK)
1133 2449
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
LCK10-J Do not use incorrect forms of the
double-checked locking idiom
Software Fault Patterns SFP19 Missing Lock
References
[REF-490]David Bacon et al. "The "Double-Checked Locking is Broken" Declaration". < http://
www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html >.
[REF-491]Jeremy Manson and Brian Goetz. "JSR 133 (Java Memory Model) FAQ". < http://
www.cs.umd.edu/~pugh/java/memoryModel/jsr-133-faq.html#dcl >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Weakness ID : 610
Structure : Simple
Abstraction : Class
Description
The product uses an externally controlled name or reference that resolves to a resource that is
outside of the intended control sphere.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CWE-610: Externally Controlled Reference to a Resource in Another Sphere