Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The general contract for the write() method says that it writes one byte to the output stream. The byte to be written constitutes the eight lower-order bits of the argument b, passed to the write() method; the 24 high-order bits of b are ignored (see [API 2006] see java.io.OutputStream.write() [API 2014] for more information).

Noncompliant Code Example

...

This compliant solution uses the writeInt() method of the DataOutputStream class, which can output the entire range of values representable as an int.:

Code Block
bgColor#ccccff
class FileWrite {
  public static void main(String[] args)
                          throws NumberFormatException, IOException { 
    DataOutputStream dos = new DataOutputStream(System.out);
    dos.writeInt(Integer.valueOf(args[0].toString()));
    System.out.flush(); 
  }     
}

...

Using the write() method to output integers outside the range 0 to 255 will result in truncation.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

FIO09-J

low

Low

unlikely

Unlikely

medium

Medium

P2

L3

Automated Detection

Automated detection of all uses of the write() method is straightforward. Sound determination of whether the truncating behavior is correct is not feasible in the general case. Heuristic checks could be useful.

Tool
Version
Checker
Description
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V

JAVA.NULL.RET.UNCHECKED

Call Might Return Null (Java)

Coverity7.5CHECKED_RETURNImplemented
Parasoft Jtest

Include Page
Parasoft_V
Parasoft_V

CERT.FIO09.ARGWRITEDo not rely on the write() method to output integers outside the range 0 to 255

Related Guidelines

MITRE CWE

CWE-252

.

, Unchecked

return value

Return Value

Bibliography

[API

2006

2014]

Class OutputStream
   Method write()

[Harold 1999]

 

 

...



...

Image Modified Image Modified Image Modified