Page History

Using Do not use the assignment operator in the outermost expression of a selection statement (if or switch) or an iteration statement (while, do, or for) shall be diagnosed because this typically indicates programmer error and can result in unexpected behavior.

Noncompliant Code Example

In this noncompliant code example, an assignment expression is the outermost expression in an if statement.

...

While the intent of the code may indeed be to assign b to a and test the value of the result for equality to zero, it is very frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==. Consequently, many compilers will warn about this condition making this coding error detectable by adhering to MSC00-C. Compile cleanly at high warning levels.

Compliant Solution

When the assignment of b to a is not intended, this conditional block is now executed when a is equal to b.

...

It is less desirable in general, depending on what was intended, because it mixes the assignment in the condition, but it is clear that the programmer intended the assignment to occur.

Risk Assessment

Errors of omission can result in unintended program flow.

Automated Detection

The LDRA tool suite Version 7.6.0 can detect violations of this recommendation???

...

Klocwork can detect violations of this rule with the ASSIGCOND.GEN, and ASSIGCOND.CALL checkers.  See Klocwork Cross Reference

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as EXP19-CPP. Do not perform assignments in conditional expressions.

Bibliography

\[[Hatton 95|AA. Bibliography#Hatton 95]\] Section 2.7.2, "Errors of omission and addition"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "KOA Likely Incorrect Expressions"
\[[MITRE 07|AA. Bibliography#MITRE 07]\] [CWE ID 480|http://cwe.mitre.org/data/definitions/480.html], "Use of Incorrect Operator"

...