CWE-474, Use of Function with Inconsistent Implementations, is about code that depends on a function whose behavior differs between operating systems or between versions of the same system. The code works on the developer's machine and does something slightly different elsewhere.
MITRE lists C and PHP, and also marks it as not language specific.
How it happens
MITRE gives the ways implementations drift apart.
- Parameters are interpreted slightly differently, so results differ.
- Some implementations carry significant security risks that others do not.
- The function is not defined on every platform.
- The set of return codes changes, or the meaning of a return code changes.
The trouble shows up when code is ported or built in an environment the author did not expect. A check that relied on one return value now sees another and takes the wrong branch.
What an attacker gains
MITRE lists the impact as quality degradation that varies by context. There is no single consequence. The effect depends on which behavior differs and what the surrounding code does with it. The record has no observed CVEs for this entry.
How to find it
MITRE names static analysis. In practice, build and run your tests on every platform and version you ship to. A test that passes on one system only is the signal.
How to fix it
MITRE's advice is to refuse inconsistent behavior when the deviation raises risk. Pin down which behavior your code needs, then wrap the function in one small internal helper that enforces it on every platform. Test the helper on all targets and use only the helper elsewhere.
Quick check
Why wrap the function instead of calling it directly?
One wrapper gives you one place to handle differences and one place to test them on each platform.
