CWE Rule 688
Description
Rule Description
The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
Polyspace Implementation
The rule checker checks for the issue Possibly incorrect function argument.
Examples
This issue occurs when there is reason to suspect that a function might be called with an incorrect variable as argument. For instance:
A global variable is used as function argument while a variable local to the caller function lies unused.
The same variable is repeated for multiple arguments of a function while a variable local to the caller function lies unused.
In all such cases, the checker message indicates the unused local variable that is a probable fix for the incorrect function argument.
The use of an incorrect variable as function argument might indicate a copy-paste or another kind of programming error. If the function being called provides access rights or performs another kind of security-related activity, the error might lead to security vulnerabilities.
Investigate if the checker has correctly determined an incorrect function argument. See if you can replace the incorrect argument with the suggested unused local variable.
In this example, the function tryGrantAccess()
is called with the global variable ADMIN_ROLES
while the local variable userRoles
is unused. Perhaps, the programmer meant to invoke the function with this local variable and depending on how tryGrantAccess()
is implemented, might be providing more privileges than intended.
#include <stdlib.h>
#include <string.h>
static const char* ADMIN_ROLES[] = { "reader", "writer", "administrator" };
extern int tryGrantAccess(const char* resource, const char** userRoles);
extern const char** getUserRoles(const char* user);
int accessGranted(const char* resource, const char* user) {
const char** const userRoles = getUserRoles(user);
return tryGrantAccess(resource, ADMIN_ROLES); //Noncompliant
}
Replace the incorrect function argument with the suggested unused local variable.
#include <stdlib.h>
#include <string.h>
static const char* ADMIN_ROLES[] = { "reader", "writer", "administrator" };
extern int tryGrantAccess(const char* resource, const char** userRoles);
extern const char** getUserRoles(const char* user);
int accessGranted(const char* resource, const char* user) {
const char** const userRoles = getUserRoles(user);
return tryGrantAccess(resource, userRoles);
}
In this example, the function tryGrantAccess()
is called with the variable ADMIN_ROLES
passed as both second and third argument, while the local variable userRoles
is unused. Perhaps, the local variable was meant to be the second argument of this function. Depending on how tryGrantAccess()
is implemented, the programmer might be providing more privileges than intended.
#include <stdlib.h>
#include <string.h>
extern int tryGrantAccess(const char* resource, const char** userRoles, const char** adminRoles);
extern const char** getUserRoles(const char* user);
int accessGranted(const char* resource, const char* user) {
static const char* ADMIN_ROLES[] = { "reader", "writer", "administrator" };
const char** const userRoles = getUserRoles(user);
return tryGrantAccess(resource, ADMIN_ROLES, ADMIN_ROLES); //Noncompliant
}
Replace the second function argument with the suggested unused local variable.
#include <stdlib.h>
#include <string.h>
extern int tryGrantAccess(const char* resource, const char** userRoles,
const char** adminRoles);
extern const char** getUserRoles(const char* user);
int accessGranted(const char* resource, const char* user) {
static const char* ADMIN_ROLES[] = { "reader", "writer", "administrator" };
const char** const userRoles = getUserRoles(user);
return tryGrantAccess(resource, userRoles, ADMIN_ROLES);
}
Check Information
Category: Others |
Version History
Introduced in R2023b
See Also
External Websites
MATLAB Command
You clicked a link that corresponds to this MATLAB command:
Run the command by entering it in the MATLAB Command Window. Web browsers do not support MATLAB commands.
웹사이트 선택
번역된 콘텐츠를 보고 지역별 이벤트와 혜택을 살펴보려면 웹사이트를 선택하십시오. 현재 계신 지역에 따라 다음 웹사이트를 권장합니다:
또한 다음 목록에서 웹사이트를 선택하실 수도 있습니다.
사이트 성능 최적화 방법
최고의 사이트 성능을 위해 중국 사이트(중국어 또는 영어)를 선택하십시오. 현재 계신 지역에서는 다른 국가의 MathWorks 사이트 방문이 최적화되지 않았습니다.
미주
- América Latina (Español)
- Canada (English)
- United States (English)
유럽
- Belgium (English)
- Denmark (English)
- Deutschland (Deutsch)
- España (Español)
- Finland (English)
- France (Français)
- Ireland (English)
- Italia (Italiano)
- Luxembourg (English)
- Netherlands (English)
- Norway (English)
- Österreich (Deutsch)
- Portugal (English)
- Sweden (English)
- Switzerland
- United Kingdom (English)