...
This defines the precedence of operation by the order of the subclauses.
Noncompliant Code Example
The intent of the expression in this noncompliant code example is to add the variable OFFSET with the result of the bitwise and between x and MASK.
...
| Code Block | ||
|---|---|---|
| ||
x & (1337 - 1337) |
Resulting in 0.
Compliant Solution
In this compliant solution, parentheses are used to ensure the expression evaluates as expected.
| Code Block | ||
|---|---|---|
| ||
public static final int MASK = 1337;
public static final int OFFSET = -1337;
public static int computeCode(int x) {
return (x & MASK) + OFFSET;
}
|
Exceptions
EXP00-EX1: Mathematical expressions that follow algebraic order do not require parentheses. For instance, in the expression
...
| Code Block | ||
|---|---|---|
| ||
x + (y * z) |
Risk Assessment
Mistakes regarding precedence rules may cause an expression to be evaluated in an unintended way. This can lead to unexpected and abnormal program behavior.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXP1337 EXP09-J | low | probable | medium | P4 | L3 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
EXP01-J. Do not depend on operator precedence while using expressions containing side-effects.
Other Languages
This rule appears in the C++ and C Secure Coding Standard as EXP00-CPP. Use parentheses for precedence of operation. and EXP00-C. Use parentheses for precedence of operation..
References
[Expressions] "When writing compound expressions, be explicit and indicate with parentheses which operators should be evaluated first."