CodeQL documentation

Ignored error status of call

ID: java/ignored-error-status-of-call
Kind: problem
Severity: recommendation
Precision: high
   - reliability
   - correctness
   - external/cwe/cwe-391
Query suites:
   - java-security-and-quality.qls

Click to see the query in the CodeQL repository

Many methods in the Java Development Kit (for examples, see the references below) return status values (for example, as an int) to indicate whether the method execution finished normally. They may return an error code if the method did not finish normally. If the method result is not checked, exceptional method executions may cause subsequent code to fail.


You should insert additional code to check the return value and take appropriate action.


The following example uses the method to read 16 bytes from an input stream and store them in an array. However, read may not actually be able to read as many bytes as requested, for example because the stream is exhausted. Therefore, the code should not simply rely on the array b being filled with precisely 16 bytes from the input stream. Instead, the code should check the method’s return value, which indicates the number of bytes actually read. is = (...);
byte[] b = new byte[16];;