...
The read methods (readByte(), readShort(), readInt(), readLong(), readFloat(), and readDouble()) and the corresponding write methods defined by class java.io.DataInputStream and class java.io.DataOutputStream operate only on big-endian data. Use of these methods while interoperating with traditional languages, such as C or and C++, is insecure because such languages lack any guarantees about endianness. This noncompliant code example shows such a discrepancy:
...
Reading and writing data without considering endianness can lead to misinterpretations of both the magnitude and sign of the data.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FIO12-J | Low | Unlikely | Low | P3 | L3 |
Automated Detection
Automated detection is infeasible in the general case.
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Parasoft Jtest |
| CERT.FIO12.PMRWLED | Provide methods to read and write little-endian data |
Related Guidelines
Bibliography
[API 2014] |
Method |
| |
"On Holy Wars and a Plea for Peace" | |
Chapter 2, "Primitive Data Types, Cross-Platform Issues" |
...
...