Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.


The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

The following example attempts to resolve a hostname.

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {
  String ip = req.getRemoteAddr();
  InetAddress addr = InetAddress.getByName(ip);
  out.println("hello " + addr.getHostName());

A DNS lookup failure will cause the Servlet to throw an exception.

Example Two

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
  //We do nothing so we just ignore the error.

The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.

Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
if (foo==NULL) {
  printf("Malloc failed to allocate memory resources");
  return -1;

Example Three

The following code mistakenly catches a NullPointerException.

try {
} catch (NullPointerException npe) {

See Also

Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Verify Message Integrity

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, ...

SFP Secondary Cluster: Unchecked Status Condition

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Comprehensive CWE Dictionary

This view (slice) covers all the elements in CWE.

Weaknesses for Simplified Mapping of Published Vulnerabilities

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the N...

Weaknesses Introduced During Implementation

This view (slice) lists weaknesses that can be introduced during implementation.

Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.