MSC19-J. Strive for logical completeness

Software vulnerabilities can result when a programmer fails to consider all possible data states.

Noncompliant Code Example (If Chain)

This noncompliant code example fails to test for conditions where a is neither b nor c. This may be the correct behavior in this case, but failure to account for all the values of a can result in logic errors if a unexpectedly assumes a different value.

if (a == b) {
  /* ... */
}
else if (a == c) {
  /* ... */
}

Compliant Solution (If Chain)

This compliant solution explicitly checks for the unexpected condition and handles it appropriately.

if (a == b) {
  /* ... */
}
else if (a == c) {
  /* ... */
}
else {
  /* handle error condition */
}

Noncompliant Code Example (Switch)

Even though x is supposed to represent a bit (0 or 1) in the code below, some error may have allowed x to assume a different value.
Detecting and dealing with that inconsistent state now rather than later will make the error easier to find and may prevent security violations.

switch(x) {
  case 0: foo(); break;
  case 1: bar(); break;
}

Compliant Solution (Switch)

The compliant solution below takes care to provide the default label to handle all valid values of type int:

switch(x) {
  case 0: foo(); break;
  case 1: bar(); break;
  default: /* handle error */ break;

Noncompliant Code Example (Zune 30)

This noncompliant code example shows incomplete logic when converting dates. The code appeared in the Zune 30 media player, causing many players to lock up on December 30, 2008, at midnight PST. This noncompliant code example comes from the ConvertDays function in the real-time clock (RTC) routines for the MC13783 PMIC RTC. This noncompliant code sample takes the number of days since January 1, 1980, and computes the correct year and number of days since January 1 of the correct year.

The flaw in the code occurs when days has the value 366 because the loop never terminates. This bug manifested itself on the 366th day of 2008, which was the first leap year in which this code was active.

final static int ORIGIN_YEAR = 1980;
UINT32 days = /* number of days since January 1, 1980 */
int year = ORIGIN_YEAR;
/* ... */

while (days > 365) {
  if (IsLeapYear(year)) {
    if (days > 366) {
      days -= 366;
      year += 1;
    }
  }
  else {
    days -= 365;
    year += 1;
  }
}

Compliant Solution (Zune 30)

This proposed rewrite is provided by http://www.aeroxp.org/2009/01/lesson-on-infinite-loops. The loop is guaranteed to exit, as days decreases for each iteration of the loop, unless the while condition fails, and the loop terminates.

final static int ORIGIN_YEAR = 1980;
UINT32 days = /* number of days since January 1, 1980 */
int year = ORIGINYEAR;
/* ... */

int daysThisYear = (IsLeapYear(year) ? 366 : 365);
while (days > daysThisYear) {
  days -= daysThisYear;
  year += 1;
  daysThisYear = (IsLeapYear(year) ? 366 : 365);
}

This compliant solution is for illustrative purposes and is not necessarily the solution implemented by Microsoft.

Risk Assessment

Failing to take into account all possibilities within a logic statement can lead to a corrupted running state, potentially resulting in unintentional information disclosure or abnormal termination.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: MSC01-CPP. Strive for logical completeness
This rule appears in the C Secure Coding Standard as MSC01-C. Strive for logical completeness.

ISO/IEC TR 24772 "CLL Switch statements and static analysis"

Bibliography

[[Hatton 1995]] Section 2.7.2, "Errors of omission and addition"
[[Viega 2005]] Section 5.2.17, "Failure to account for default case in switch"
[http://www.aeroxp.org/2009/01/lesson-on-infinite-loops] for analysis on the Zune 30 bug

MSC00-C. Compile cleanly at high warning levels      49. Miscellaneous (MSC)      MSC02-C. Avoid errors of omission