CWE-686 使用不正确参数类型的函数调用

Function Call With Incorrect Argument Type

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The software calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

扩展描述

This weakness is most likely to occur in loosely typed languages, or in strongly typed languages in which the types of variable arguments cannot be enforced at compilation time, or where there is implicit casting.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 628 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 628 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围	影响	注释
Other	Quality Degradation

可能的缓解方案

Testing

策略:

Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the software. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
CERT C Secure Coding	EXP37-C	CWE More Specific	Call functions with the correct number and type of arguments
CERT C Secure Coding	FIO47-C	Imprecise	Use valid format strings
CERT C Secure Coding	POS34-C		Do not call putenv() with a pointer to an automatic variable as the argument
CERT C Secure Coding	STR37-C		Arguments to character handling functions must be representable as an unsigned char
Software Fault Patterns	SFP1		Glitch in computation

文章来源于互联网:scap中文网