Comparing instead of Assigning

Opis

The code uses an operator for comparison when the intention was to perform an assignment.

In many languages, the compare statement is very close in appearance to the assignment statement; they are often confused.

Skutki

• Availability, Integrity

  Unexpected State

  The assignment will not take place, which should cause obvious program execution problems.

Zapobieganie

• Testing

  Many IDEs and static analysis products will detect this problem.

Słabość nadrzędna

• CWE-480 Use of Incorrect Operator

Kiedy powstaje

• Implementation — This bug primarily originates from a typo.

Dotyczy

C, C++

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 6, "Typos", Page 289, Addison Wesley, 2006