Reviewing Code for Race Conditions  Revision as of 11:10, 13
August 2007 by EoinKeary (Talk | contribs)  Jump to: navigation,
search OWASP Code Review Guide Table of Contents    Race
conditions: Race Conditions occur when a piece of code does not
work as it is supposed to (like many security issues). They are
the result of an unexpected ordering of events which can result
in the finite state machine of the code to transition to a
undefined state and also give rise to contention of more than
one thread of execution over the same resource. Multiple threads
of execution acting or manipulating the same area in memory or
persisted data which gives rise to integrity issues.  How they
work:  With competing tasks manipulating the same resource we
can easly get a race condition as the resource is not in step-
lock or utilises a token based multi-use system such as
semaphores.  Say we have two processes (Thread 1, T1) and
(Thread 2, T2). The code in question adds 10 to an integer X.
The initial valus of X is 5.  X = X +