Page History

Software vulnerabilities can result when a programmer fails to consider all possible data states.

Noncompliant Code Example (if chain)

This noncompliant code example fails to test for conditions where a is neither b nor c. This may be the correct behavior in this case, but failure to account for all the values of a may result in logic errors if a unexpectedly assumes a different value.

if (a == b) {
  /* ... */
}
else if (a == c) {
  /* ... */
}

Compliant Solution (if chain)

This compliant solution explicitly checks for the unexpected condition and handles it appropriately.

if (a == b) {
  /* ... */
}
else if (a == c) {
  /* ... */
}
else {
  /* handle error condition */
}

Noncompliant Code Example (switch)

This noncompliant code example fails to consider all possible cases. This may be the correct behavior in this case, but failure to account for all the values of widget_type may result in logic errors if widget_type unexpectedly assumes a different value or if its valid range is expanded during code maintenance and the programmer overlooks the need to add a case to the switch.

...

Microsoft Visual C++ .NET with /W4 does not warn when assigning an integer value to an enum type, or when the switch statement does not contain all possible values of the enumeration.

Compliant Solution (switch)

This compliant solution explicitly checks for the unexpected condition by adding a default clause to the switch statement.

...

Existing implementations are in transition, with some not yet analyzing switch statements with default labels. Developers must take extra care to check their own switch statements until the new practice becomes universal.

Noncompliant Code Example (Zune 30)

This code example appeared in the Zune 30 media player, causing many players to lock up on December 30, 2008, at midnight PST. This code sample comes from the ConvertDays function in the Real-time clock (RTC) routines for the MC13783 PMIC RTC. The ConvertDays function takes a number of days since the MS-DOS epoch (January 1, 1980), and returns the corresponding day, month, and year values. This code sample takes the number of days, and computes the year and number of days since January 1 of the correct year.

#define ORIGINYEAR 1980 
UINT32 days = /* number of days since January 1, 1980 */
int year = ORIGINYEAR;
/* ... */

while (days > 365) {
  if (IsLeapYear(year)) {
    if (days > 366) {
      days -= 366;
      year += 1;
    }
  }
  else {
    days -= 365;
    year += 1;
  }
}

The code has a logical flaw. When days has the value 366, the loop never terminates. This bug manifested itself on the 366th day of 2008, which was the first leap year in which this code was active.

Compliant Solution (Zune 30)

This proposed rewrite is provided by \[[http://www.aeroxp.org/2009/01/lesson-on-infinite-loops]\]. The loop is guaranteed to exit, as {{days}} decreases for each iteration of the loop, unless the {{while}} condition fails, and the loop consequently terminates.

#define ORIGINYEAR 1980 
UINT32 days = /* input parameter */
int year = ORIGINYEAR;
/* ... */

int daysThisYear = (IsLeapYear(year) ? 366 : 365);
while (days > daysThisYear) {
  days -= daysThisYear;
  year += 1;
  daysThisYear = (IsLeapYear(year) ? 366 : 365);
}

Risk Assessment

Failing to take into account all possibilities within a logic statement can lead to a corrupted running state, potentially resulting in unintentional information disclosure or abnormal termination.

...

\[[Hatton 95|AA. C References#Hatton 95]\] Section 2.7.2, "Errors of omission and addition"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "CLL Switch statements and static analysis"
\[[Viega 05|AA. C References#Viega 05]\] Section 5.2.17, "Failure to account for default case in switch"
\[[http://www.aeroxp.org/2009/01/lesson-on-infinite-loops]\] for analysis on the Zune 30 bug

...

      49. Miscellaneous (MSC)      MSC02-C. Avoid errors of omission