CWE-688, Function Call With Incorrect Variable or Reference as Argument, is a caller that hands a function the wrong variable. The types fit, the code compiles, and the function operates on the wrong thing. MITRE lists C and Perl as the affected platforms.
Like its siblings, it typically comes from a typo or a copy and paste error.
How it happens
MITRE's observed example is CVE-2005-2548: kernel code specifies the wrong variable in the first argument, leading to a resultant NULL pointer dereference.
A generic illustration of the copy and paste shape:
// Vulnerable: second block was copied from the first; "a" should be "b"
copy_name(a, src_a);
copy_name(a, src_b); // b is never filled in, a is overwritten
What an attacker gains
MITRE records quality degradation. In the CVE above the effect was a NULL pointer dereference, which usually means a crash. In kernel code, a crash is a denial of service for the whole machine.
How to find it
MITRE says the flaw tends to produce incorrect behavior and so is often found in testing, and that exercising all control paths will expose it except when the wrong variable accidentally gives the right result. Static analysis tools that warn on suspicious duplicated code or unused variables point at these spots. Code review is effective if reviewers read each argument against the function's purpose.
How to fix it
Call the function with the intended variable, then reduce the chance of the mistake coming back.
- Avoid duplicating blocks. Loop or factor out a helper.
- Enable warnings for unused variables and values that are set but never read.
- Write tests that check each output, not only that the call succeeded.
for (int i = 0; i < 2; i++) {
copy_name(names[i], srcs[i]);
}
Quick check
What is a good sign that the wrong variable was passed?
A variable that is declared and set but never used, next to one that is used twice.
