Call to Thread run() instead of start()

Draft Variant

Structure: Simple

Description

The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.

Extended Description

In most cases a direct call to a Thread object's run() method is a bug. The programmer intended to begin a new thread of control, but accidentally called run() instead of start(), so the run() method will execute in the caller's thread of control.

Common Consequences 1

Scope: Other

Impact: Quality DegradationVaries by Context

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Implementation

Use the start() method instead of the run() method.

Demonstrative Examples 1

The following excerpt from a Java program mistakenly calls run() instead of start().

Code Example:Bad
Java
java

Applicable Platforms

Languages:

Java : Undetermined

Modes of Introduction

Implementation

Affected Resources

System Process

Related Weaknesses

ChildOf:

Incorrect Synchronization (CWE-821)

Taxonomy Mapping

The CERT Oracle Secure Coding Standard for Java (2011)
Software Fault Patterns