Do not use the assignment operator in the outermost expression of a selection statement (if or switch) or an iteration statement (while, do, or for) because this typically indicates programmer error and can result in unexpected behavior.
Noncompliant Code Example
In this noncompliant code example, an assignment expression is the outermost expression in an if statement.
if (a = b) {
/* ... */
}
While the intent of the code may be to assign b to a and test the value of the result for equality to zero, it is very frequently a case of the programmer mistakenly using the assignment operator = instead of the equals operator ==. Consequently, many compilers will warn about this condition making this coding error detectable by adhering to recommendation MSC00-C. Compile cleanly at high warning levels.
Compliant Solution
When the assignment of b to a is not intended, this conditional block is now executed when a is equal to b.
if (a == b) {
/* ... */
}
When the assignment is, if fact, intended, this is an alternative compliant solution:
if ((a = b) != 0) {
/* ... */
}
It is less desirable in general, depending on what was intended because it mixes the assignment in the condition, but it is clear that the programmer intended the assignment to occur.
Risk Assessment
Errors of omission can result in unintended program flow.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
EXP18-C |
low |
likely |
medium |
P6 |
L2 |
Automated Detection
Tool |
Version |
Checker |
Description |
|---|---|---|---|
Unable to render {include} The included page could not be found. |
|
|
|
GCC |
Unable to render {include} The included page could not be found. |
|
can detect violations of this recommendation when the |
Compass/ROSE |
|
|
could detect violations of this recommendation by identifying any assignment expression as the top-level expression in an if or while statement. |
| 2024.3 | ASSIGCOND.GEN ASSIGCOND.CALL |
|
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
CERT C++ Secure Coding Standard: EXP19-CPP. Do not perform assignments in conditional expressions
ISO/IEC TR 24772 "KOA Likely Incorrect Expressions"
MITRE CWE: CWE-480, "Use of Incorrect Operator"
Bibliography
[[Hatton 1995]] Section 2.7.2, "Errors of omission and addition"
EXP17-C. Do not perform bitwise operations in conditional expressions 03. Expressions (EXP) EXP19-C. Use braces for the body of an if, for, or while statement