CWE-483, Incorrect Block Delimitation, is about code that does not explicitly mark a block intended to hold two or more statements. In some languages the braces are optional, and leaving them out lets a logic error slip in. MITRE lists C and C++.
The best known real case is a certificate validation bypass that sat in a widely used operating system library.
How it happens
When a block has no braces, only the first statement belongs to it. Indentation fools the reader, but the compiler ignores indentation.
// Vulnerable: the second goto is NOT inside the if
if (check_a(ctx) != 0)
goto fail;
goto fail; /* always runs */
if (check_b(ctx) != 0)
goto fail;
/* never reached: security check skipped */
The second goto fail runs every time. Everything after it is skipped, including the checks the developer thought were still protecting the code.
This is the pattern behind CVE-2014-1266. MITRE's record describes it as a chain: an incorrect goto in an Apple SSL product bypasses certificate validation, allowing an adversary in the middle attack. It is widely known as the Apple "goto fail" bug.
What an attacker gains
MITRE lists altered execution logic affecting confidentiality, integrity and availability. It notes that such a logic error often leads to obviously incorrect behavior that is quickly noticed and fixed. In lightly tested or untested code, the error may reach production and provide additional attack surface. The goto fail case shows what that looks like when the skipped code is a security check.
How to find it
Static analysis can find some instances. Many compilers can also warn about misleading indentation and unreachable code. Turn on those warnings.
Test the failure path. A certificate check test that only uses a valid certificate will pass even when the check is gone. Add a test with a bad certificate.
How to fix it
MITRE's guidance: always use explicit block delimitation, and use static analysis to enforce it.
if (check_a(ctx) != 0) {
goto fail;
}
if (check_b(ctx) != 0) {
goto fail;
}
Adopt a formatter or linter rule that requires braces on every if, else, for and while, even for one line bodies. It costs nothing and removes the class of bug.
Quick check
Why did the extra goto look fine in review?
The indentation made it appear to belong to the if. The compiler does not read indentation, so a reviewer has to count statements, not just look at the layout.
