Page History

The logical AND and logical OR operators (&&, and ||, respectively) exhibit "short-circuit" operation. That is, the second operand is not evaluated if the result can be deduced solely by evaluating the first operand. Consequently,

Programmers should exercise caution if the second operand should not contain contains side effects because it would may not be apparent whether the side effect occurseffects actually occur.

Non-Compliant Code Example

In this non-compliant code exampleIn the following code, the value of i is incremented only when i >= 0.:

enum { max = 15 };
int i = /* initializeInitialize to user -supplied value */;

if ( (i >= 0) && ( (i++) <= max) ) {
  /* codeCode */
}

Although the behavior is well - defined, it is not immediately obvious how this code behaves.

Compliant Solution

This compliant solution exhibits identical behavior but is easier to understand.

enum { max = 15 };
int i = /* initialize to user supplied value */;

if (i >= 0) {
  i++;
  if  (i <= max) {
    /* code */
  }
}

whether or not i gets incremented.

Noncompliant

...

Code Example

In this non-compliant noncompliant code example, the second operand of the logical OR operator invokes a function that results in side effects.:

char *p = /* Initialize; may or may not be NULL */

if ( p || (p = (char *) malloc(BUF_SIZE)) ) {
  /* do stuff withPerform some computation based on p */
}
  free(p);
  p = NULL;
} else {
  /* handleHandle malloc() error */
   return;
}

Because malloc() is called only if p is NULL when entering the if clause, free() might be called with a pointer to local data not allocated by malloc(). (See MEM34-C. Only free memory allocated dynamically.) This behavior is partially due to the uncertainty of whether or not malloc() is actually called.

Compliant Solution

This compliant solution exhibits identical behavior but is easier to understandIn this compliant solution, a second pointer, q, is used to indicate whether malloc() is called; if not, q remains set to NULL. Passing NULL to free() is guaranteed to safely do nothing.

char *p = /* Initialize; may or may not be NULL */
char *pq = NULL;
if (p == NULL) {
  pq = (char *) malloc(BUF_SIZE);
  p = q;
}
if (p == NULL) {
  /* Handle handlemalloc() error */
  return;
}

/* Perform some docomputation stuffbased withon p */
free(q);
q = NULL;

Risk Assessment

Attempting to modify an object that is the second operand to Failing to understand the short-circuit behavior of the logical OR or AND operator may cause that object to take on an unexpected value. This can lead to unintended program behavior.

Automated Detection

...

The LDRA tool suite V 7.6.0 is able to detect violations of this recommendation.

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V	logop-side-effect	Fully checked
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC-EXP02	Fully implemented
Compass/ROSE			Could detect possible violations of this recommendation by reporting expressions with side effects, including function calls, that appear on the right-hand side of an && or || operator
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C3415
Klocwork	Include Page Klocwork_V Klocwork_V	MISRA.LOGIC.SIDEEFF
LDRA tool suite	Include Page LDRA_V LDRA_V	35 D 1 Q 133 S 406 S 408 S	Fully implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-EXP02-a	The right-hand operand of a logical && or || operator shall not contain side effects
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	9007	Fully supported
RuleChecker	Include Page RuleChecker_V RuleChecker_V	logop-side-effect	Fully checked
SonarQube C/C++ Plugin	Include Page SonarQube C/C++ Plugin_V SonarQube C/C++ Plugin_V	SideEffectInRightHandSideOfLogical

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.5.13, "Logical AND operator," and Section 6.5.14, "Logical OR operator"

Related Guidelines

...

Image Added Image Added Image AddedEXP01-A. Do not take the size of a pointer to determine the size of the pointed-to type      03. Expressions (EXP)       EXP03-A. Do not assume the size of a structure is the sum of the sizes of its members