CWE-234 — Failure to Handle Missing Parameter
CWE-234: Failure to Handle Missing Parameter
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | High |
Description
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
Common consequences
- Integrity, Confidentiality, Availability, Access Control: Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity
- Availability: DoS: Crash, Exit, or Restart
Mitigations
Build and Compilation — This issue can be simply combated with the use of proper build process.
Implementation — Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.
References
- CWE page: https://cwe.mitre.org/data/definitions/234.html
- CWE list: https://cwe.mitre.org/data/index.html