write() method, defined in the class
java.io.OutputStream, takes an argument of type
int the value of which must be in the range 0 to 255. Because a value of type
int could be outside this range, failure to range check can result in the truncation of the higher-order bits of the argument.
The general contract for the
write() method says that it writes one byte to the output stream. The byte to be written constitutes the eight lower-order bits of the argument
b, passed to the
write() method; the 24 high-order bits of
b are ignored (see
java.io.OutputStream.write() [API 2014] for more information).
Noncompliant Code Example
This noncompliant code example accepts a value from the user without validating it. Any value that is not in the range of 0 to 255 is truncated. For instance,
/ on ASCII-based systems because the lower-order 8 bits of 303 are used while the 24 high-order bits are ignored (303 % 256 = 47, which is the ASCII code for
/). That is, the result is the remainder of the input divided by 256.
Compliant Solution (Range-Check Inputs)
This compliant solution prints the corresponding character only if the input integer is in the proper range. If the input is outside the representable range of an
Integer.valueOf() method throws a
NumberFormatException. If the input can be represented by an
int but is outside the range required by
write(), this code throws an
Compliant Solution (
This compliant solution uses the
writeInt() method of the
DataOutputStream class, which can output the entire range of values representable as an
write() method to output integers outside the range 0 to 255 will result in truncation.
Automated detection of all uses of the
write() method is straightforward. Sound determination of whether the truncating behavior is correct is not feasible in the general case. Heuristic checks could be useful.
Call Might Return Null (Java)
|CERT.FIO09.ARGWRITE||Do not rely on the write() method to output integers outside the range 0 to 255|