{"@ID": "768", "@Name": "Incorrect Short Circuit Evaluation", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects.", "Extended_Description": {"xhtml:p": "If the first condition of an \"or\" statement is assumed to be true under normal circumstances, or if the first condition of an \"and\" statement is assumed to be false, then any subsequent conditional may contain its own logic errors that are not detected during code review or testing.", "#text_blocks": ["If the first condition of an \"or\" statement is assumed to be true under normal circumstances, or if the first condition of an \"and\" statement is assumed to be false, then any subsequent conditional may contain its own logic errors that are not detected during code review or testing."]}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "705", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": [{"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, {"@Name": "C", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Likelihood_Of_Exploit": "Low", "Common_Consequences": {"Consequence": [{"Scope": ["Confidentiality", "Integrity", "Availability"], "Impact": "Varies by Context", "Note": "Widely varied consequences are possible if an attacker is aware of an unexpected state in the product after a conditional. Usage of short circuit evaluation, though well-defined in the C standard, may alter control flow in a way that introduces logic errors that are difficult to detect, possibly causing errors later during the product's execution. It may lead to information exposure, a system crash, or even complete attacker control of the system."}, {"Scope": "Other", "Impact": "Unexpected State", "Note": "This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring."}, {"Scope": "Other", "Impact": "Reduce Maintainability", "Note": "The usage of short circuit evaluation may decrease the maintainability of the code."}]}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Description": "Minimizing the number of statements in a conditional that produce side effects will help to prevent the likelihood of short circuit evaluation to alter control flow in an unexpected way."}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "The following function attempts to take a size value from a user and allocate an array of that size (we ignore bounds checking for simplicity). The function tries to initialize each spot with the value of its index, that is, A[len-1] = len - 1; A[len-2] = len - 2; ... A[1] = 1; A[0] = 0; However, since the programmer uses the prefix decrement operator, when the conditional is evaluated with i == 1, the decrement will result in a 0 value for the first part of the predicate, causing the second portion to be bypassed via short-circuit evaluation. This means we cannot be sure of what value will be in A[0] when we return the array to the user.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:br": [null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": null, "#text": "int privileges;int id;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "users[i].id = i;"}, "#text": "user_t* users = (user_t*)calloc(num_users, sizeof(user_t));int i = num_users;while( --i && (users[i].privileges = PRIV_REGULAR) ){}return users;"}, {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "#text": "user_t* test;int i;test = Add_Regular_Users(25);for(i = 0; i < 25; i++) printf(\"user %d has privilege level %d\\n\", test[i].id, test[i].privileges);"}], "#text": "#define PRIV_ADMIN 0#define PRIV_REGULAR 1typedef struct{} user_t;user_t *Add_Regular_Users(int num_users){}int main(){}"}, "#text_blocks": ["#define PRIV_ADMIN 0", "#define PRIV_REGULAR 1", "typedef struct{", "int privileges;", "int id;", "} user_t;", "user_t *Add_Regular_Users(int num_users){", "user_t* users = (user_t*)calloc(num_users, sizeof(user_t));", "int i = num_users;", "while( --i && (users[i].privileges = PRIV_REGULAR) ){", "users[i].id = i;", "}", "return users;", "}", "int main(){", "user_t* test;", "int i;", "test = Add_Regular_Users(25);", "for(i = 0; i < 25; i++) printf(\"user %d has privilege level %d\\n\", test[i].id, test[i].privileges);", "}"]}, "Body_Text": "When compiled and run, the above code will output a privilege level of 1, or PRIV_REGULAR for every user but the user with id 0 since the prefix increment operator used in the if statement will reach zero and short circuit before setting the 0th user's privilege level. Since we used calloc, this privilege will be set to 0, or PRIV_ADMIN."}}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "CLASP", "Entry_Name": "Failure to protect stored data from modification"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP1", "Entry_Name": "Glitch in computation"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2009-03-03", "Submission_Version": "1.4", "Submission_ReleaseDate": "2009-05-27"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-09-27", "Modification_Version": "1.10", "Modification_ReleaseDate": "2010-09-27", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-09-13", "Modification_Version": "2.1", "Modification_ReleaseDate": "2011-09-13", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Likelihood_of_Exploit, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Common_Consequences, Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Detection_Factors, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Common_Consequences, Description, Relationships, Type"}]}, "entry_type": "Weakness"}