CWE-687: Function Call With Incorrectly Specified Argument Value
Function Call With Incorrectly Specified Argument Value
Weakness ID: 687 (Weakness Variant)
Status: Draft
Description
Description Summary
The software calls a function, procedure, or routine, but the
caller specifies an argument that contains the wrong value, which may lead to
resultant weaknesses.
Time of Introduction
Implementation
Detection Factors
This might require an understanding of intended program behavior or
design to determine whether the value is incorrect.
Demonstrative Examples
Example 1
This Perl code intends to record whether a user authenticated
successfully or not, and to exit if the user fails to authenticate. However,
when it calls ReportAuth(), the third argument is specified as 0 instead of
1, so it does not exit.
When primary, this weakness is most likely to occur in rarely-tested code,
since the wrong value can change the semantic meaning of the program's
execution and lead to obviously-incorrect behavior. It can also be resultant
from issues in which the program assigns the wrong value to a variable, and
that variable is later used in a function call. In that sense, this issue
could be argued as having chaining relationships with many implementation
errors in CWE.
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
CERT C Secure Coding
MEM04-C
Do not perform zero length allocations
Content History
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Eric Dalci
Cigital
External
updated Potential Mitigations
2008-09-08
CWE Content Team
MITRE
Internal
updated Detection Factors, Relationships, Other Notes,
Weakness Ordinalities
Description
