Undefined behavior

8.<x> <unique immutable identifier> < undefined behavior>

8.<x>.1 Description of application vulnerability

The behavior of a program that depends on a construct having undefined behavior is not predictable.

8.<x>.2 Cross reference

Ada: Clause 3.4.3 undefined behavior

C: Clause 3.4.3 undefined behavior

C++: Clause 1.3.12 undefined behavior

Fortran: ???

CWE: Nothing applicable

8.<x>.3 Categorization

See clause 5.1.3.

8.<x>.4 Mechanism of failure

Language specifications often call out when the behavior of a language construct is undefined (i.e., no specific behavior is required and the translator or runtime system is at liberty to do anything it pleases).

8.<x>.5 Possible ways to avoid the vulnerability

This vulnerability can be avoided by not using the construct or using it in a way that guarantees that the domain of its behavior does not fall into undefined behavior.

8.<x>.6 Assumed variations among languages

This vulnerability is intended to be applicable to languages with the following characteristics:

8.<x>.7 Avoiding the vulnerability or mitigating its effects

Software developers can avoid the vulnerability or mitigate its ill effects in the following ways:

History

Version 1, 30 June 2007, Author: Derek M. Jones, derek@knosof.co.uk