Comparing instead of assigning

Overview

In many languages, the compare statement is very close in appearance to the assignment statement; they are often confused.

Consequences

Unspecified.

Exposure period

• Pre-design through Build: The use of tools to detect this problem is recommended.

• Implementation: Many logic errors can lead to this condition. It can be exacerbated by lack, or misuse, of mitigating technologies.

Platform

• Languages: C, C++, Java

• Operating platforms: Any

Required resources

Any

Severity

High

Likelihood of exploit

Low

Avoidance and mitigation

• Pre-design: Through Build: Many IDEs and static analysis products will detect this problem.

Discussion

This bug is mainly a typo and usually should cause obvious problems with program execution. The assignment will not always take place.

Examples

In C/C++/Java:

void called(int foo){
        foo==1;
        if (foo==1) printf("foo\n");
}

int main(){
        called(2);
        return 0;
}