The code contains a switch statement in which the switched
variable can be modified while the switch is still executing, resulting in
unexpected behavior.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Common Consequences
Scope
Effect
This flaw will result in the system state going out of sync.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
(Bad Code)
C and C++
#include <sys/types.h>
#include <sys/stat.h>
int main(argc,argv){
struct stat *sb;
time_t timer;
lstat("bar.sh",sb);
printf("%d\n",sb->st_ctime);
switch(sb->st_ctime % 2){
case 0: printf("One option\n");
break;
case 1: printf("another option\n");
break;
default: printf("huh\n");
break;
}
return 0;
}
Potential Mitigations
Phase
Description
Implementation
Variables that may be subject to race conditions should be locked for
the duration of any switch statements.
Other Notes
This issue is particularly important in the case of switch statements that
involve fall-through style case statements -- ie., those which do not end
with break. If the variable which we are switching on change in the course
of execution, the actions carried out may place the state of the process in
a contradictory state or even result in memory corruption. For this reason,
it is important to ensure that all variables involved in switch statements
are locked before the statement starts and are unlocked when the statement
ends.
Description
