Page History

Do Mixing bitwise and relational operators in the same full expression can be a sign of a logic error in the expression where a logical operator is usually the intended operator. Do not use the bitwise AND (&), ampersand) or bitwise OR (|), pipe) operator in a conditional expression because this typically indicates programmer error and can result in unexpected behavior. Only use & or | only for bitwise operations, and to use && or || only for logical operationsor bitwise XOR (^) operators with an operand of type _Bool, or the result of a relational-expression or equality-expression. If the bitwise operator is intended, it should be indicated with use of a parenthesized expression.

Noncompliant Code Example

In this noncompliant code example, a bitwise expression is used in a conditional expression. bitwise & operator is used with the results of two equality-expressions:

if (!(getuid() == 0 & geteuidgetgid() == 0)) { 
  /* ... */ 
} 

Compliant Solution

This compliant solution uses the && operator for the logical operation within the conditional expression.:

if (!(getuid() == 0 && geteuidgetgid() == 0)) {
  /* ... */
}

Bibliography

Risk Assessment

Automated Detection

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-480 and EXP46-C

Intersection( EXP45-C, EXP46-C) = Ø

CWE-480 = Union( EXP46-C, list) where list =

• Usage of incorrect operator besides s/&/&&/ or s/|/||/

Bibliography

...

Image Added Image Added Image Added Wiki Markup\[Hatton 95\] Section 2.7.2, "Errors of omission and addition" \[ISO/IEC PDTR 24772\] "KOA Likely Incorrect Expressions" \[Seacord 09\] "MSC02-C. Avoid errors of omission"