CWE-628 使用不正确指定参数的函数调用

Function Call with Incorrectly Specified Arguments

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown


The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.


There are multiple ways in which this weakness can be introduced, including:


  • cwe_Nature: ChildOf cwe_CWE_ID: 573 cwe_View_ID: 1000 cwe_Ordinal: Primary


Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}


范围 影响 注释
['Other', 'Access Control'] ['Quality Degradation', 'Gain Privileges or Assume Identity'] This weakness can cause unintended behavior and can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.



Since these bugs typically introduce obviously incorrect behavior, they are found quickly, unless they occur in rarely-tested code paths. Managing the correct number of arguments can be made more difficult in cases where format strings are used, or when variable numbers of arguments are supported.


Build and Compilation


Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA.

Architecture and Design


Make sure your API's are stable before you use them in production code.


The following PHP method authenticates a user given a username/password combination but is called with the parameters in reverse order.

bad PHP

function authenticate($username, $password) {

// authenticate user

authenticate($_POST['password'], $_POST['username']);

This Perl code intends to record whether a user authenticated successfully or not, and to exit if the user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0 instead of 1, so it does not exit.

bad Perl

sub ReportAuth {
my ($username, $result, $fatal) = @_;
PrintLog("auth: username=%s, result=%d", $username, $result);
if (($result ne "success") && $fatal) {
die "Failed!\n";

sub PrivilegedFunc
my $result = CheckAuth($username);
ReportAuth($username, $result, 0);

In the following Java snippet, the accessGranted() method is accidentally called with the static ADMIN_ROLES array rather than the user roles.

bad Java

private static final String[] ADMIN_ROLES = ...;
public boolean void accessGranted(String resource, String user) {
String[] userRoles = getUserRoles(user);
return accessGranted(resource, ADMIN_ROLES);

private boolean void accessGranted(String resource, String[] userRoles) {

// grant or deny access based on user roles


标识 说明 链接


映射的分类名 ImNode ID Fit Mapped Node Name
CERT C Secure Coding DCL10-C Maintain the contract between the writer and caller of variadic functions
CERT C Secure Coding EXP37-C CWE More Abstract Call functions with the correct number and type of arguments
SEI CERT Perl Coding Standard DCL00-PL CWE More Abstract Do not use subroutine prototypes
SEI CERT Perl Coding Standard EXP33-PL Imprecise Do not invoke a function in a context for which it is not defined