CWE-628: Function Call with Incorrectly Specified Arguments

Description

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

There are multiple ways in which this weakness can be introduced, including:

Potential Impact

Demonstrative Examples

function authenticate($username, $password) {
                        
                           
                           // authenticate user
                           ...
                     }
                     authenticate($_POST['password'], $_POST['username']);

sub ReportAuth {my ($username, $result, $fatal) = @_;PrintLog("auth: username=%s, result=%d", $username, $result);if (($result ne "success") && $fatal) {die "Failed!\n";}}
                     sub PrivilegedFunc{my $result = CheckAuth($username);ReportAuth($username, $result, 0);DoReallyImportantStuff();}

private static final String[] ADMIN_ROLES = ...;public boolean void accessGranted(String resource, String user) {String[] userRoles = getUserRoles(user);return accessGranted(resource, ADMIN_ROLES);}
                     private boolean void accessGranted(String resource, String[] userRoles) {
                        
                           
                           // grant or deny access based on user roles
                           ...
                     }

Mitigations & Prevention

Detection Methods

• Other — Since these bugs typically introduce incorrect behavior that is obvious to users, they are found quickly, unless they occur in rarely-tested code paths. Managing the correct number of arguments can be made more difficult in cases where format strings are used, or when variable numbers of arguments a

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• CERT C Secure Coding: DCL10-C — Maintain the contract between the writer and caller of variadic functions
• CERT C Secure Coding: EXP37-C — Call functions with the correct number and type of arguments
• SEI CERT Perl Coding Standard: DCL00-PL — Do not use subroutine prototypes
• SEI CERT Perl Coding Standard: EXP33-PL — Do not invoke a function in a context for which it is not defined