EXP04-J. Do not perform assignments in conditional statements

Do not use the assignment operator in the outermost expression of an if or switch statement or a looping statement (while, do, or for) because this typically indicates programmer error and can result in unexpected behavior.

Noncompliant Code Example

In this noncompliant code example, an assignment expression is the outermost expression in an if statement.

if (a = b) {
  /* ... */
}

While the intent of the code could be to assign b to a and test the value of the result for equality to zero, it is frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==.

Compliant Solution

When the assignment of b to a is unintended, this conditional block is now executed when a is equal to b.

if (a == b) {
  /* ... */
}

When the assignment is intended, the following compliant solution may be used because the programmer's intent is clearer:

if ((a = b) == true) {
  /* ... */
}

Although it could be preferable to express this same logic as an assignment followed by a conditional:

a = b;
if (a == 0) {
  /* ... */
}

Risk Assessment

Errors of omission can result in unintended program flow.

Related Guidelines

CERT C Secure Coding Standard: "EXP18-C. Do not perform assignments in selection statements"
CERT C++ Secure Coding Standard: "EXP19-CPP. Do not perform assignments in conditional expressions"
ISO/IEC TR 24772 "KOA Likely Incorrect Expressions"

MITRE CWE: CWE-480, "Use of Incorrect Operator"

Bibliography

[[Hatton 1995]] Section 2.7.2, "Errors of omission and addition"

NUM18-J. Be aware of numeric promotion behavior      02. Expressions (EXP)      EXP07-J. Understand the differences between bitwise and logical operators