Assigning instead of comparing

From OWASP

Jump to: navigation, search


Overview

In many languages the compare statement is very close in appearance to the assignment statement and are often confused.

Consequences

Unspecified.

Exposure period

  • Pre-design through Build: The use of tools to detect this problem is recommended.
  • Implementation: Many logic errors can lead to this condition. It can be exacerbated by lack, or misuse, of mitigating technologies.

PlatforM

  • Languages: C, C++
  • Operating platforms: Any

Required resources

Any

Severity

High

Likelihood of exploit

Low

Avoidance and mitigation

  • Pre-design: Through Build: Many IDEs and static analysis products will detect this problem.
  • Implementation: Place constants on the left. If one attempts to assign a constant with a variable, the compiler will of course produce an error.

Discussion

This bug is generally as a result of a typo and usually should cause obvious problems with program execution. If the comparison is in an if statement, the if statement will always return the value of the right-hand side variable.

Examples

In C/C++/Java: 

void called(int foo){
        if (foo=1)  printf("foo\n");
}

int main(){
        called(2);
        return 0;
}

Related problems

Comparing instead of assigning

Retrieved from "http://www.owasp.org/index.php/Assigning_instead_of_comparing"
Personal tools