Code that does not perform any action, or has an unintended effect can result in unexpected behavior and vulnerabilities. Statements or expressions that have no effect should be identified and removed from code.
Non-Compliant Code Example 1
In this example, a is compared with b. The comparison of a against b has no effect.
...
This is likely a case of the programmer mistakenly using the equals operator == instead of the assignment operator =.
Compliant Solution 1
The assignment of b to a is now properly performed.
| Code Block | ||
|---|---|---|
| ||
int a; a = b; |
Non-Compliant Code Example 2
In this example, p is incremented and then dereferenced, However, *p in this example has no effect.
| Code Block | ||
|---|---|---|
| ||
int *p; *p++; |
Compliant Solution 2
Correcting this example depends on the programmers intent. For instance, if dereferencing p was done on accident, then p should not be dereferenced.
...
| Code Block | ||
|---|---|---|
| ||
int *p; (*p)++ |
Risk Assessment
The presence of code that has no effect could indicate logic errors that may result in unexpected behavior and vulnerabilities.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSCXX MSC12-A | 1 (low) | 1 (unlikely) | 2 (medium) | P2 | L3 |
Automated Detection
The Coverity Prevent NO_EFFECT checker finds statements or expressions that do not accomplish anything, or statements that perform an unintended action. Coverity Prevent cannot discover all violations of this rule so further verification is necessary.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERTwebsite.
References
*Coverity 07 Section 6.1.9, "NO_EFFECT"