CWE-686 使用不正确参数类型的函数调用

Function Call With Incorrect Argument Type

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

The software calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

扩展描述

This weakness is most likely to occur in loosely typed languages, or in strongly typed languages in which the types of variable arguments cannot be enforced at compilation time, or where there is implicit casting.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 628 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 628 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Other Quality Degradation

可能的缓解方案

Testing

策略:

Because this function call often produces incorrect behavior it will usually be detected during testing or normal operation of the software. During testing exercise all possible control paths will typically expose this weakness except in rare cases when the incorrect function call accidentally produces the correct results or if the provided argument type is very similar to the expected argument type.

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
CERT C Secure Coding EXP37-C CWE More Specific Call functions with the correct number and type of arguments
CERT C Secure Coding FIO47-C Imprecise Use valid format strings
CERT C Secure Coding POS34-C Do not call putenv() with a pointer to an automatic variable as the argument
CERT C Secure Coding STR37-C Arguments to character handling functions must be representable as an unsigned char
Software Fault Patterns SFP1 Glitch in computation