CWE-628: Function Call with Incorrectly Specified Arguments
Function Call with Incorrectly Specified Arguments
Weakness ID: 628 (Weakness Base)
Status: Draft
Description
Description Summary
The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrectbehavior and resultant weaknesses.
Extended Description
There are multiple ways in which this weakness can be introduced, including:
the wrong variable or reference;
an incorrect number of arguments;
incorrect order of arguments;
wrong type of arguments; or
wrong value.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Other
Technical Impact: Quality degradation
Detection Methods
Other
Since these bugs typically introduce obviously incorrect behavior,
they are found quickly, unless they occur in rarely-tested code paths.
Managing the correct number of arguments can be made more difficult in
cases where format strings are used, or when variable numbers of
arguments are supported.
The method calls the functions with the wrong
argument order, which allows remote attackers to bypass intended access
restrictions.
Potential Mitigations
Once found, these issues are easy to fix. Use code inspection tools
and relevant compiler features to identify potential violations. Pay
special attention to code that is not likely to be exercised heavily
during QA.
Make sure your API's are stable before you use them in production
code.
Weakness Ordinalities
Ordinality
Description
Primary
This is usually primary to other weaknesses, but it can be resultant
if the function's API or function prototype changes.
Description
