/* goodG2B() - use goodsource and badsink by changing the conditions on the first and second while statements */
private void goodG2B() throws Throwable {
String data;
boolean local_f = false;
while (true) {
/* FIX: call getStringG(), which will never return null */
data = CWE690_NULL_Deref_from_Return__Class__Helper.getStringGood();
break;
}
while (local_f) {
/* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
/* POTENTIAL FLAW: Call getStringG(), which may return null */
data = CWE690_NULL_Deref_from_Return__Class__Helper.getStringBad();
break;
}
while (true) {
/* POTENTIAL FLAW: data could be null */
String sOut = data.trim();
IO.writeLine(sOut);
break;
}
while (local_f) {
/* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
/* FIX: explicit check for null */
if (data != null) {
String sOut = data.trim();
IO.writeLine(sOut);
}
break;
}
}
public void bad() throws Throwable {
String data;
boolean local_f = false; /* This local variable is used becuase the
Java compiler will generate an error on while(false) and similar
constructs that evaluate to false. This is the simplest construct
that will always be false and still compile. */
while (local_f) {
/* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
/* FIX: call getStringG(), which will never return null */
data = CWE690_NULL_Deref_from_Return__Class__Helper.getStringGood();
break;
}
while (true) {
/* POTENTIAL FLAW: Call getStringG(), which may return null */
data = CWE690_NULL_Deref_from_Return__Class__Helper.getStringBad();
break;
}
while (true) {
/* POTENTIAL FLAW: data could be null */
String sOut = data.trim();
IO.writeLine(sOut);
break;
}
while (local_f) {
/* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
/* FIX: explicit check for null */
if (data != null) {
String sOut = data.trim();
IO.writeLine(sOut);
}
break;
}
}
