CWE-670: Always-Incorrect Control Flow Implementation
Always-Incorrect Control Flow Implementation
Weakness ID: 670 (Weakness Class)
Status: Draft
Description
Description Summary
The code contains a control flow path that does not reflect the
algorithm that the path is intended to implement, leading to incorrect behavior
any time this path is navigated.
Extended Description
This weakness captures cases in which a particular code segment is always
incorrect with respect to the algorithm that it is implementing. For
example, if a C programmer intends to include multiple statements in a
single block but does not include the enclosing braces (CWE-483), then the
logic is always incorrect. This issue is in contrast to most weaknesses in
which the code usually behaves correctly, except when it is externally
manipulated in malicious ways.
Time of Introduction
Architecture and Design
Implementation
Operation
Modes of Introduction
This issue typically appears in rarely-tested code, since the
"always-incorrect" nature will be detected as a bug during normal
usage.
This node could possibly be split into lower-level nodes. "Early Return"
is for returning control to the caller too soon (e.g., CWE-584). "Excess
Return" is when control is returned too far up the call stack (CWE-600,
CWE-395). "Improper control limitation" occurs when the product maintains
control at a lower level of execution, when control should be returned
"further" up the call stack (CWE-455). "Incorrect syntax" covers code that's
"just plain wrong" such as CWE-484 and CWE-483.
Content History
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Eric Dalci
Cigital
External
updated Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Description, Relationships,
Other Notes
2009-07-27
CWE Content Team
MITRE
Internal
updated Maintenance Notes, Modes of Introduction,
Other Notes, Relationships
Description
