Unexpected Status Code or Return Value
Draft Base
Structure: Simple
Description
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
Common Consequences 1
Scope: IntegrityOther
Impact: Unexpected StateAlter Execution Logic
Observed Examples 8
CVE-2004-1395Certain packets (zero byte and other lengths) cause a recvfrom call to produce an unexpected return code that causes a server's listening loop to exit.
CVE-2002-2124Unchecked return code from recv() leads to infinite loop.
CVE-2005-2553Kernel function does not properly handle when a null is returned by a function call, causing it to call another function that it shouldn't.
CVE-2005-1858Memory not properly cleared when read() function call returns fewer bytes than expected.
CVE-2000-0536Bypass access restrictions when connecting from IP whose DNS reverse lookup does not return a hostname.
CVE-2001-0910Bypass access restrictions when connecting from IP whose DNS reverse lookup does not return a hostname.
CVE-2004-2371Game server doesn't check return values for functions that handle text strings and associated size values.
CVE-2005-1267Resultant infinite loop when function call returns -1 value.
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Implementation
Related Weaknesses
Taxonomy Mapping
- PLOVER
- Software Fault Patterns
- SEI CERT Perl Coding Standard
Notes
RelationshipUsually primary, but can be resultant from issues such as behavioral change or API abuse. This can produce resultant vulnerabilities.