The conditional AND and OR operators (&& and ||, respectively) exhibit short-circuit behavior. That is, the second operand is evaluated only when the result of the conditional operator cannot be deduced solely by evaluating the first operand. Consequently, when the result of the conditional operator can be deduced solely from the result of the first operand, the second operand will remain unevaluated; its side - effects, if any, will never occur.
In the following code, the value of i is incremented only when i >= 0.
The bitwise AND and OR operators (& and |) lack short-circuit behavior. Similar to most Java operators, they evaluate both operands. They return the same Boolean result as && and || respectively but can have different overall effects depending on the presence or absence of side effects in the second operand.
Consequently, either the & or the && operator can be used when performing Boolean logic. However, there are times when the short-circuiting behavior is preferred and other times when the short-circuiting behavior causes subtle bugs.
Noncompliant Code Example (Improper &)
This noncompliant code example, derived from Flanagan [Flanagan 2005], has two variables with unknown variables. The code must validate its data and then check whether array[i] is a valid index.
| Code Block | ||
|---|---|---|
| ||
int array[]; // May be null
int i; // May be an invalid index for array
if (array != null & | ||
| Code Block | ||
int i = // initialize to user supplied value if ((i >= 0) & i < array.length & ((i++) <= Integer.MAX_VALUE))array[i] >= 0) { // Use array } else { // Handle ...error } |
Although the behavior is well defined, it is unclear whether i is incremented on any particular execution.
Noncompliant Code Example
This noncompliant code example attempts to rename a given file if it exists, perform operations on the renamed file, and then delete the renamed file. For the purposes of this example, we assume that the file operations are performed on a secure portion of the filesystem. Consequently, we need not consider the time-of-check to time-of-use vulnerabilities that would otherwise be of concern.
When the exists() method returns true, execution continues with the call to File.delete(); the call to File.renameTo() remains unexecuted in this case. Consequently, the code as written fails to guarantee the existence of the renamed file, which can result in an attempt to use and subsequently to delete a nonexistent file. Further, File.delete() returns an error code on failure rather than throwing an exception; this noncompliant example incorrectly ignores the return value from File.delete() (see guideline EXP00-J. Do not ignore values returned by methods).
| Code Block | ||
|---|---|---|
| ||
class BadRenameFile {
public static void main(String[] args) {
File fOriginal = new File("original.txt");
File fNew = new File("new.txt");
if (fOriginal.exists() || fOriginal.renameTo(fNew)) {
// do something with fNew
fNew.delete();
}
}
}
|
Compliant Solution
This compliant solution checks both for the existence of the original file as well as for the success of the rename operation. It also handles the error when either check fails. It deletes the new file when operations are complete, checking for and handling the possible failure of the delete operation.
This code can fail as a result of the same errors it is trying to prevent. When array is NULL or i is not a valid index, the reference to array and array[i] will cause either a NullPointerException or an ArrayIndexOutOfBoundsException to be thrown. The exception occurs because the & operator fails to prevent evaluation of its right operand even when evaluation of its left operand proves that the right operand is inconsequential.
Compliant Solution (Use &&)
This compliant solution mitigates the problem by using &&, which causes the evaluation of the conditional expression to terminate immediately if any of the conditions fail, thereby preventing a runtime exception:
| Code Block | ||
|---|---|---|
| ||
int array[]; // May be null
int i; // May be an invalid index for array
if (array != null && i >= 0 &&
i < array.length && array[i] >= 0) {
// Handle array
} else {
// Handle error
}
|
Compliant Solution (Nested if Statements)
This compliant solution uses multiple if statements to achieve the proper effect.
| Code Block | ||
|---|---|---|
| ||
int array[]; // May be null
int i; // May be a valid index for array
if (array != null) {
if (i >= 0 && i < array.length) {
if (array[i] >= 0 | ||
| Code Block | ||
| ||
class RenameFile { public static void main(String[] args) { File fOriginal = new File("original.txt"); File fNew = new File("new.txt"); if (!fOriginal.exists()) { // handleUse errorarray } if (!fOriginal.renameTo(fNew)) else { // handleHandle error } // do something with fNew if (!fNew.delete())} else { // handleHandle error } } else { } // Handle }error } |
Although correct, this solution is more verbose and could be more difficult to maintain. Nevertheless, this solution is preferable when the error-handling code for each potential failure condition is different.
Noncompliant Code Example (Improper &&)
This noncompliant code example demonstrates code that compares two arrays for ranges of members that match. Here i1 and i2 are valid array indices in array1 and array2 respectively. Variables end1 and end2 are the indices of the ends of the matching ranges in the two arrays.When error handling for failure of the existence and rename operations is identical, that portion of the code could be rewritten as:
| Code Block | ||
|---|---|---|
| ||
if (end1 >= 0 if (!fOriginal.exists() || !fOriginal.renameTo(fNew))& i2 >= 0) { int begin1 = i1; //int handlebegin2 error= i2; while } |
In this form, the short-circuit behavior of the || operation provides identical semantics to the "two-if-statement" version shown above.
Exceptions
(++i1 < array1.length &&
++i2 < array2.length &&
array1[i1] == array2[i2]) {
// Arrays match so far
}
int end1 = i1;
int end2 = i2;
assert end1 - begin1 == end2 - begin2;
}
|
The problem with this code is that when the first condition in the while loop fails, the second condition does not execute. That is, once i1 has reached array1.length, the loop terminates after i1 is incremented. Consequently, the apparent range over array1 is larger than the apparent range over array2, causing the final assertion to fail.
Compliant Solution (Use &)
This compliant solution mitigates the problem by judiciously using &, which guarantees that both i1 and i2 are incremented regardless of the outcome of the first conditionWiki Markup
| Code Block | ||
|---|---|---|
| ||
if (data != null && i < datapublic void exampleFunction() { while (++i1 < array1.length & // Not && ++i2 < array2.length && data[i] != -1) ... |
This code snippet sequentially checks for potential error conditions before allowing the main computation to proceed. The short-circuit behavior of && guarantees that the first error condition encountered will terminate the checking process.
...
array1[i1] == array2[i2]){
//doSomething
}
} |
Applicability
Failure to understand the short-circuit behavior of the logical AND bitwise and OR conditional operators can cause unintended program behavior.
...
...
Severity
...
Likelihood
...
Remediation Cost
...
Priority
...
Level
...
EXP07-J
...
low
...
unlikely
...
medium
...
P2
...
L3
Automated Detection
Detection of short-circuit operators is straightforward, but sound error checking for this guideline is not feasible in the general case. Heuristic warnings could be useful.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Related Guidelines
CERT C Secure Coding Standard: EXP02-C. Be aware of the short-circuit behavior of the logical AND and OR operators
CERT C++ Secure Coding Standard: EXP02-CPP. Be aware of the short-circuit behavior of the logical AND and OR operators
Bibliography
...
...
[ |
...
...
...
] | §2.5.6. |
...
, "Boolean |
...
Operators |
...
" |
[ |
...
...
...
...
...
...
...
EXP06-J. Use parentheses for precedence of operation 04. Expressions (EXP)