Page History

Do Mixing bitwise and relational operators in the same full expression can be a sign of a logic error in the expression where a logical operator is usually the intended operator. Do not use the bitwise AND (&), ampersand) or bitwise OR (|), pipe) operator in a conditional expression because this typically indicates programmer error and can result in unexpected behavior. Use & or | only for bitwise operations and use && or || only for logical operationsor bitwise XOR (^) operators with an operand of type _Bool, or the result of a relational-expression or equality-expression. If the bitwise operator is intended, it should be indicated with use of a parenthesized expression.

Noncompliant Code Example

In this noncompliant code example, a bitwise expression is used in a conditional expression. bitwise & operator is used with the results of two equality-expressions:

if (!(getuid() == 0 & geteuidgetgid() == 0)) { 
  /* ... */ 
} 

Compliant Solution

This compliant solution uses the && operator for the logical operation within the conditional expression.:

if (!(getuid() == 0 && geteuidgetgid() == 0)) {
  /* ... */
}

Risk Assessment

Automated Detection

Related Guidelines

ISO/IEC TR 24772 "KOA Likely Incorrect Expressions"

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-480 and EXP46-C

Intersection( EXP45-C, EXP46-C) = Ø

CWE-480 = Union( EXP46-C, list) where list =

• Usage of incorrect operator besides s/&/&&/ or s/|/||/

...

Bibliography

...

...

...

Image Removed      03. Expressions (EXP)      EXP18-C. Do not perform assignments in selection statementsImage Added Image Added Image Added