CWE-772: Missing Release of Resource after Effective Lifetime
查看自定义信息:
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
与观点“研究概念”相关(CWE-1000)
与“软件开发”视图相关(CWE-699)
与“简化已发表漏洞的简化映射”(CWE-1003)相关的视图相关(CWE-1003)
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
与“ CISQ数据保护措施”(CWE-1340)有关
该清单显示了可能出现的弱点的可能区域。这些可能适用于特定的命名语言,操作系统,体系结构,范式,技术或一类此类平台。该平台与给定弱点出现在该实例的频率一起列出。
技术 课程:移动设备(Undetermined Prevalence)
该表指定与弱点相关的不同个人后果。该范围确定了违反的应用程序安全区域,而影响描述了如果对手成功利用这一弱点,就会产生负面的技术影响。其可能性提供了有关预期相对于列表中其他后果的特定后果的可能性的信息。例如,可能会利用弱点来实现一定的影响,但很可能会利用它来实现不同的影响。
示例1 以下方法永远不会关闭新文件句柄。如果有足够的时间,BufferReader的finalize()方法最终应调用Close(),但是不能保证此操作将需要多长时间。实际上,无法保证最终确定()将永远被调用。在繁忙的环境中,操作系统可以在调用Close()函数之前用尽所有可用的文件句柄。
(bad code)
示例语言:爪哇
private void processFile(string fName)
{
BufferReader fil = new BufferReader(new FileReader(fName)); }字符串线; while(((line = fil.readline())!= null) {
processLine(line); }好的代码示例只需在系统完成文件完成时,将一个明确的调用添加到CLOSE()函数。在这样的简单示例中,问题很容易看到和解决。在实际系统中,问题可能更加晦涩。
(好代码)
示例语言:爪哇
private void processFile(string fName)
{
BufferReader fil = new BufferReader(new FileReader(fName)); }字符串线; while(((line = fil.readline())!= null) {
processLine(line); }fil.close(); 示例2 以下代码尝试打开与数据库的新连接,处理数据库返回的结果,并关闭分配的SQLConnection对象。
(bad code)
示例语言:C#
sqlConnection conn = new SQLConnection(connstring);
sqlcommand cmd = new sqlCommand(querystring); cmd.connection = conn; conn.open(); sqldatareader rdr = cmd.executereader(); HarvestResults(RDR); conn.connection.close(); 上述代码的问题是,如果执行SQL或处理结果时发生异常,则SQLConnection对象未关闭。如果经常发生这种情况,数据库将用完可用的光标,并且无法执行更多的SQL查询。 示例3 This code attempts to open a connection to a database and catches any exceptions that may occur.
(bad code)
示例语言:爪哇
尝试 {
连接con = drivermanager.getConnection(some_connection_string); }catch ( Exception e ) {
log(e); }如果在建立数据库连接后并在相同的连接关闭之前发生异常,则数据库连接池可能会耗尽。如果超过可用连接的数量,其他用户将无法访问此资源,从而有效拒绝访问该应用程序。 示例4 在正常情况下,以下C#代码执行数据库查询,处理数据库返回的结果,并关闭分配的SQLConnection对象。但是,如果执行SQL或处理结果时发生异常,则SQLConnection对象未关闭。如果经常发生这种情况,数据库将用完可用的光标,并且无法执行更多的SQL查询。
(bad code)
示例语言:C#
...
sqlConnection conn = new SQLConnection(connstring); sqlcommand cmd = new sqlCommand(querystring); cmd.connection = conn; conn.open(); sqldatareader rdr = cmd.executereader(); HarvestResults(RDR); conn.connection.close(); ... 示例5 The following C function does not close the file handle it opens if an error occurs. If the process is long-lived, the process can run out of file handles.
(bad code)
示例语言:C
int decodeFile(char* fName) {
char buf[BUF_SZ];
文件* f = fopen(fname,“ r”); 如果(!f){
printf(“不能打开%s \ n”,fname); }return DECODE_FAIL; 别的 {
while(fgets(buf,buf_sz,f)){
如果(!checkCheckSum(buf)){ }
return DECODE_FAIL; }别的 {
去塑解(buf); }fclose(f); return DECODE_SUCCESS;
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
提供更多信息 - 请选择其他过滤器。
|
使用共同弱点枚举(CWE)和本网站的相关参考使用条款。CWE由美国国土安全部(DHS)Cybersecurity and Infrastructure Security Agency(CISA),由Homeland Security Systems Engineering and Development Institute(HSSEDI)由manbetx客户端首页(MITER)。版权所有©2006–2023,Miter Comanbetx客户端首页rporation。CWE,CWSS,CWRAF和CWE徽标是Miter Corporation的商标。manbetx客户端首页 |