Szczegóły CWE-670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

This weakness captures cases in which a particular code segment is always incorrect with respect to the algorithm that it is implementing. For example, if a C programmer intends to include multiple statements in a single block but does not include the enclosing braces (CWE-483), then the logic is always incorrect. This issue is in contrast to most weaknesses in which the code usually behaves correctly, except when it is externally manipulated in malicious ways.

Sposoby wprowadzenia

Implementation : This issue typically appears in rarely-tested code, since the "always-incorrect" nature will be detected as a bug during normal usage.

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Typowe konsekwencje

Zaobserwowane przykłady

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is a Class and might have Base-level children that would be more appropriate
Komentarz : Examine children of this entry to see if there is a better fit

Notatki

This node could possibly be split into lower-level nodes. "Early Return" is for returning control to the caller too soon (e.g., CWE-584). "Excess Return" is when control is returned too far up the call stack (CWE-600, CWE-395). "Improper control limitation" occurs when the product maintains control at a lower level of execution, when control should be returned "further" up the call stack (CWE-455). "Incorrect syntax" covers code that's "just plain wrong" such as CWE-484 and CWE-483.

Zgłoszenie

Modyfikacje