Detection of Error Condition Without Action

The software detects a specific error, but takes no actions to handle the error.


Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
  //We do nothing so we just ignore the error.
}

The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.

Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
  printf("Malloc failed to allocate memory resources");
  return -1;
}

Example Two

In the following C++ example the method readFile() will read the file whose name is provided in the input parameter and will return the contents of the file in char string. The method calls open() and read() may result in errors if the file does not exist or does not contain any data to read. These errors will be thrown when the is_open() method and good() method indicate errors opening or reading the file. However, these errors are not handled within the catch statement. Catch statements that do not perform any processing will have unexpected results. In this case an empty char string will be returned, and the file will not be properly closed.

char* readfile (char *filename) {

  try {

    // open input file
    ifstream infile;
    infile.open(filename);

    if (!infile.is_open()) {
      throw "Unable to open file " + filename;
    }

    // get length of file
    infile.seekg (0, ios::end);
    int length = infile.tellg();
    infile.seekg (0, ios::beg);

    // allocate memory
    char *buffer = new char [length];

    // read data from file
    infile.read (buffer,length);

    if (!infile.good()) {
      throw "Unable to read from file " + filename;
    }

    infile.close();

    return buffer;

  }
  catch (...) {
    /* bug: insert code to handle this later */
  }

}

The catch statement should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following C++ example contains two catch statements. The first of these will catch a specific error thrown within the try block, and the second catch statement will catch all other errors from within the catch block. Both catch statements will notify the user that an error has occurred, close the file, and rethrow to the block that called the readFile() method for further handling or possible termination of the program.

char* readFile (char *filename) {

  try {

    // open input file
    ifstream infile;
    infile.open(filename);

    if (!infile.is_open()) {
      throw "Unable to open file " + filename;
    }

    // get length of file
    infile.seekg (0, ios::end);
    int length = infile.tellg();
    infile.seekg (0, ios::beg);

    // allocate memory
    char *buffer = new char [length];

    // read data from file
    infile.read (buffer,length);

    if (!infile.good()) {
      throw "Unable to read from file " + filename;
    }
    infile.close();

    return buffer;

  }
  catch (char *str) {
    printf("Error: %s \n", str);
    infile.close();
    throw str;
  }
  catch (...) {
    printf("Error occurred trying to read from file \n");
    infile.close();
    throw;
  }

}

Example Three

In the following Java example the method readFile will read the file whose name is provided in the input parameter and will return the contents of the file in a String object. The constructor of the FileReader object and the read method call may throw exceptions and therefore must be within a try/catch block. While the catch statement in this example will catch thrown exceptions in order for the method to compile, no processing is performed to handle the thrown exceptions. Catch statements that do not perform any processing will have unexpected results. In this case, this will result in the return of a null String.

public String readFile(String filename) {

  String retString = null;
  try {

    // initialize File and FileReader objects
    File file = new File(filename);
    FileReader fr = new FileReader(file);

    // initialize character buffer
    long fLen = file.length();
    char[] cBuf = new char[(int) fLen];

    // read data from file
    int iRead = fr.read(cBuf, 0, (int) fLen);

    // close file
    fr.close();

    retString = new String(cBuf);


  } catch (Exception ex) {
    /* do nothing, but catch so it'll compile... */
  }
  return retString;

}

The catch statement should contain statements that either attempt to fix the problem, notify the user that an exception has been raised and continue processing, or perform some cleanup and gracefully terminate the program. The following Java example contains three catch statements. The first of these will catch the FileNotFoundException that may be thrown by the FileReader constructor called within the try/catch block. The second catch statement will catch the IOException that may be thrown by the read method called within the try/catch block. The third catch statement will catch all other exceptions thrown within the try block. For all catch statements the user is notified that the exception has been thrown and the exception is rethrown to the block that called the readFile() method for further processing or possible termination of the program. Note that with Java it is usually good practice to use the getMessage() method of the exception class to provide more information to the user about the exception raised.

public String readFile(String filename) throws FileNotFoundException, IOException, Exception {

  String retString = null;
  try {

    // initialize File and FileReader objects
    File file = new File(filename);
    FileReader fr = new FileReader(file);

    // initialize character buffer
    long fLen = file.length();
    char [] cBuf = new char[(int) fLen];

    // read data from file
    int iRead = fr.read(cBuf, 0, (int) fLen);

    // close file
    fr.close();

    retString = new String(cBuf);


  } catch (FileNotFoundException ex) {
    System.err.println ("Error: FileNotFoundException opening the input file: " + filename );
    System.err.println ("" + ex.getMessage() );
    throw new FileNotFoundException(ex.getMessage());
  } catch (IOException ex) {
    System.err.println("Error: IOException reading the input file.\n" + ex.getMessage() );
    throw new IOException(ex);
  } catch (Exception ex) {
    System.err.println("Error: Exception reading the input file.\n" + ex.getMessage() );
    throw new Exception(ex);
  }
  return retString;

}

See Also

CISQ Quality Measures - Reliability

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Verify Message Integrity

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, ...

SFP Secondary Cluster: Unchecked Status Condition

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Comprehensive CWE Dictionary

This view (slice) covers all the elements in CWE.

CWE Cross-section

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful t...

Weaknesses Introduced During Implementation

This view (slice) lists weaknesses that can be introduced during implementation.


Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.