CWE-1265—Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls

Weakness Name

Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls

Description

The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally produces a nested invocation of the non-reentrant code.

In a complex product, a single function call may lead to many different possible code paths, some of which may involve deeply nested calls. It may be difficult to foresee all possible code paths that could emanate from a given function call, even if that call is assumed to be reentrant. In some systems, an external actor can manipulate inputs to the system and thereby achieve a wide range of possible control flows. This is frequently a concern in products that execute scripts from untrusted sources. Examples of such products are web browsers and PDF readers. A weakness is present when one of the possible code paths resulting from a function call alters program state that the original caller assumes to be unchanged during the call.

Common Consequences

Scope:

Integrity

Impact:

Unexpected State

Notes:

Exploitation of this weakness can leave the application in an unexpected state and cause variables to be reassigned before the first invocation has completed. This may eventually result in memory corruption or unexpected code execution.

Related Weaknesses

• CWE-416Use After FreeHigh
• CWE-662Improper Synchronization
• CWE-663Use of a Non-reentrant Function in a Concurrent Context