Comparing instead of Assigning
This vulnerability occurs when a developer accidentally uses a comparison operator (like '==') where an assignment operator (like '=') was intended, creating a logic error instead of setting a value.
This common coding mistake happens because assignment and comparison operators look very similar in many programming languages. For example, using `if (x = 5)` instead of `if (x == 5)` assigns the value 5 to `x` and then evaluates the assignment's result as the condition, which is often always true, breaking the intended program logic. To prevent this, developers should adopt defensive coding habits like placing constants on the left side in comparisons (e.g., `if (5 == x)`), which would cause a compilation error if written incorrectly as `if (5 = x)`. Modern compilers and linters often flag this pattern with warnings like "possible unintended assignment," which should always be investigated and corrected.
Impact: Unexpected State
The assignment will not take place, which should cause obvious program execution problems.
Code Example:
javaID : DX-103
The following C/C++ example shows a simple implementation of a stack that includes methods for adding and removing integer values from the stack. The example uses pointers to add and remove integer values to the stack array variable.Code Example:
c// Print stack overflow error message and exit* } *p1 == i;}
cc// initialize tos and p1 to point to the top of stack* tos = stack; p1 = stack;
cLow
- CLASP
- Software Fault Patterns