Page History

...

The general contract for the {{write()}} method says that it writes one byte to the output stream. The byte to be written constitutes the eight lower order bits of the argument {{b}}, passed to the {{write()}} method.; Thethe 24 high-order bits of {{b}} are ignored (see \[[API 2006|AA. Bibliography#API 06]\] [{{java.io.OutputStream.write()}}|http://download.oracle.com/javase/6/docs/api/java/io/OutputStream.html#write(int)] for more information).

Noncompliant Code Example

This noncompliant code example accepts a value from the user without validating it. Any value that is not in the range of 0 to 255 is truncated. For instance, write(303) prints / on ASCII-based systems because the lower order 8 bits of 303 are preserved used while the top 24 high-order bits are lost ignored (303 mod 256 is 47 and / has ASCII code 47). That is, the result is remainder modulo 256 of the absolute value of the input.

class ConsoleWrite {
  public static void main(String[] args) { 
    //Any input value > 255 will result in unexpected output
    System.out.write(Integer.valueOf(args[0].toString()));
    System.out.flush();
  }
}

Compliant Solution (Use System.out.print* methods)

Use alternative means to output integers such as the System.out.print* methods.

class ConsoleWrite {
  public static void main(String[] args) { 
    System.out.println(args[0]);
  }
}

Compliant Solution (

...

Range-check inputs)

Alternatively, perform range checking to be compliant. While this particular compliant solution still does not fails to display the original out-of-range integer correctly, it behaves well when the corresponding read() method is used to convert the byte value back to a value of type int. This is because it guarantees that the byte variable will contain representable data.

class FileWrite {
  public static void main(String[] args) throws NumberFormatException, IOException { 
    FileOutputStream  out = new FileOutputStream("output");   

    //Perform range checking  
    if(Integer.valueOf(args[0]) < 0 || Integer.valueOf(args[0]) > 255) {
      throw new ArithmeticException("Value is out of range");
    }
  
    out.write(Integer.valueOf(args[0].toString()));
    System.out.flush(); 
  }
}

Note that a NumberFormatException results when attempting to use the Integer.valueOf() method, if When args0 contains a value that is larger than the maximum value falls outside the representable range of an int, the Integer.valueOf() method throws a NumberFormatException.

Compliant Solution (Use writeInt(

...

))

This compliant solution uses the writeInt() method of the DataOutputStream class.

...

Using the write() method to output integers writes only the low-order 8 bits of the integers. This truncation may result in unexpected values.

Automated Detection

TODOAutomated detection of all uses of the write() method is straightforward. Sound determination of whether the truncating behavior is correct is not feasible in the general case. Heuristic checks may be useful.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

...