Inaccurate Comments

Description

Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

In the following Java example the code performs a calculation to determine how much medicine to administer. A comment is provided to give insight into what the calculation shoud be doing. Unfortunately the comment does not match the actual code and thus leaves the reader to wonder which is correct.

public class Main {

  public static void main(String[] args) {
    int pt_weight = 83;
    int mg_per_kg = 3;
    int daily_dose = 0;

    // Add the patient weight and Mg/Kg to calculate the correct daily dose
    daily_dose = pt_weight * mg_per_kg;
    return dosage;
  }
}

In the correction below, the code functionality has been verified, and the comment has been corrected to reflect the proper calculation.

public class Main {

  public static void main(String[] args) {
    int pt_weight = 83;
    int mg_per_kg = 3;
    int daily_dose = 0;

    // Multiply the patient weight and Mg/Kg to calculate the correct daily dose
    daily_dose = pt_weight * mg_per_kg;
    return dosage;
  }
}

Note that in real-world code, these values should be validated to disallow negative numbers, prevent integer overflow, etc.

See Also