Identifier name reuse

8.<x> <unique immutable identifier> < Identifier name reuse>

8.<x>.1 Description of application vulnerability

When distinct identifiers are defined using the same name it is possible that when one of the definitions is deleted from the source the program will continue to compile without a diagnostic being issued.

8.<x>.2 Cross reference

CWE: Nothing applicable

8.<x>.3 Categorization

See clause 5.2.

8.<x>.4 Mechanism of failure

Many languages support the concept of scope. One of the ideas behind the concept of scope is to provide a mechanism for the independent definition of identifiers that may share the same name.

For instance, in the following code fragment:


int some_var;

   {
   int t_var;
   int some_var; /* definition in nested scope */

   t_var=3;
   some_var=2;
   }

an identifier called some_var has been defined in different scopes.

If the either the definition of some_var or t_var that occurs in the nested scope is deleted (e.g., when the source is modified) it is necessary to delete all other references to that identifier within the scope. If a developer deletes the definition of t_var but fails to delete the statement that references it, then most languages require a diagnostic to be issued (e.g., reference to undefined variable). However, if the nested definition of some_var is deleted but the reference to it in the nested scope is not deleted, then no diagnostic will be issued (because the reference resolves to the definition in the outer scope).

8.<x>.5 Possible ways to avoid the vulnerability

New identifiers should not be defined using a name that is already visible within which the scope of the new definition.

8.<x>.6 Assumed variations among languages

This vulnerability is intended to be applicable to languages with the following characteristics:

8.<x>.7 Avoiding the vulnerability or mitigating its effects

Software developers can avoid the vulnerability or mitigate its ill effects in the following ways:

History

Version 1, 30 June 2007, Author: Derek M. Jones, derek@knosof.co.uk