UNINIT.CTOR.MIGHT.UNCLEAR
Uninitialized class member use under an unresolved condition
The UNINIT.CTOR.MIGHT.UNCLEAR checker finds cases in which a class field may be passed to a function that reads it only when a condition holds and Klocwork can neither prove nor disprove that condition. To report this checker, set the KW_RW_CONDITIONAL environment variable to a value other than 0. This checker is disabled by default.
Vulnerability and risk
In C++, primitive data type variables need to be initialized explicitly. When a method or helper function reads a class field only under a condition that cannot be resolved, the resulting behavior can still be unpredictable and may have security implications.
Mitigation and prevention
Make sure constructors initialize all class fields before any method or helper function can read them. If you enable conditional R/W knowledge base support with KW_RW_CONDITIONAL, expect slower analysis times on some projects.
Vulnerable code example
extern bool enabled();
class C {
public:
int value;
C(bool init) {
if (init) {
value = 0;
}
}
};
void use_if_enabled(C *arg) {
if (enabled()) {
int copy = arg->value;
(void)copy;
}
}
int main() {
C item(false);
use_if_enabled(&item);
return 0;
}Klocwork flags line 23, indicating that the call to use_if_enabled may read the uninitialized class field item.value when the condition inside use_if_enabled cannot be resolved.