...
Although it advises against depending on parentheses for specifying evaluation order,EXP08 EXP05-J. Do not write more than once to the same variable within an expression applies only to expressions that contain side effects.
Noncompliant Code Example
The intent of the expression in this noncompliant code example is to add the variable OFFSET
to the result of the bitwise logical AND between x
and MASK
.
Code Block | ||
---|---|---|
| ||
public static final int MASK = 1337;
public static final int OFFSET = -1337;
public static int computeCode(int x) {
return x & MASK + OFFSET;
}
|
According to the operator precedence guidelines, the expression is parsed as the following:
Code Block |
---|
x & (MASK + OFFSET)
|
This expression gets evaluated, as follows, resulting in the value 0.
Code Block |
---|
x & (1337 - 1337)
|
Compliant Solution
This compliant solution uses parentheses to ensure that the expression evaluates as intended.
Code Block | ||
---|---|---|
| ||
public static final int MASK = 1337;
public static final int OFFSET = -1337;
public static int computeCode(int x) {
return (x & MASK) + OFFSET;
}
|
Exceptions
EXP06EXP53-EX0: Parentheses may be omitted from mathematical expressions that follow the algebraic precedence rules. For instance, consider the expression:
Code Block |
---|
x + y * z
|
By mathematical convention, multiplication is performed before addition; parentheses are redundant in this case.
Code Block | ||
---|---|---|
| ||
x + (y * z)
|
Risk Assessment
Mistakes regarding precedence guidelines can cause an expression to be evaluated in an unintended way. This can lead to unexpected and abnormal program behavior.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
EXP06EXP53-J JG | low | probable | medium | P4 | L3 |
Automated Detection
Detection of all expressions using low-precedence operators without parentheses is straightforward. Determining the correctness of such uses is infeasible in the general case; heuristic warnings could be useful.
Related Guidelines
C Coding Standard: EXP00-C. Use parentheses for precedence of operation
C++ Secure Coding Standard: EXP00-CPP. Use parentheses for precedence of operation
Bibliography
[ESA 2005] | Rule 65: Use parentheses to explicitly indicate the order of execution of numerical operators |
| |
Rule 77: Clarify the order of operations with parentheses |
EXP51-JG. Do not perform assignments in conditional statements 02. Expressions (EXP) EXP54-J. Understand the differences between bitwise and logical operators