76 vulnerabilities classified as CWE-252 (未加检查的返回值). AI Chinese analysis included.
CWE-252 represents a critical programming weakness where software fails to verify the return value of a function or method, often stemming from the erroneous assumption that operations cannot fail or that their failure is inconsequential. This oversight allows attackers to exploit the vulnerability by forcing functions to return unexpected error codes or null values, thereby disrupting the intended execution flow. When the program proceeds without validating these outcomes, it may operate in an unstable state, leading to data corruption, denial of service, or privilege escalation. To mitigate this risk, developers must rigorously implement error-handling routines that explicitly check return statuses. By treating every function call as potentially hazardous and ensuring subsequent logic accounts for failure conditions, programmers can prevent attackers from manipulating program state through unchecked return values.
char buf[10], cp_buf[10]; fgets(buf, 10, stdin); strcpy(cp_buf, buf);int returnChunkSize(void *) { /* if chunk info is valid, return the size of usable memory, * else, return -1 to indicate an error */ ... } int main() { ... memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1)); ... }Vulnerabilities classified as CWE-252 (未加检查的返回值) represent 76 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.