CWE一覧に戻る
CWE-234

欠落したパラメータの処理の失敗

Failure to Handle Missing Parameter
脆弱性 作成中
JA

関数に送られる引数が少なすぎる場合でも、関数はスタックから期待される数の引数をポップする。潜在的には、関数の中で可変数の引数を使い果たす可能性もある。

EN

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Scope: Integrity, Confidentiality, Availability, Access Control / Impact: Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Scope: Availability / Impact: DoS: Crash, Exit, or Restart
This issue can be simply combated with the use of proper build process.
Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.
MITRE公式ページ — CWE-234