Mixing bitwise and relational operators in the same full expression can be a sign of a logic error in the expression where a logical operator is usually the intended operator. Do not use the bitwise AND (&), bitwise OR (|), or bitwise XOR (^) operators with an operand of type _Bool, or the result of a relational-expression or equality-expression. If the bitwise operator is intended, it should be indicated with use of a parenthesized expression.

Noncompliant Code Example

In this noncompliant code example, a bitwise & operator is used with the results of an equality-expression:

if (!(getuid() & geteuid() == 0)) { 
  /* ... */ 
} 

Compliant Solution

This compliant solution uses the && operator for the logical operation within the conditional expression:

if (!(getuid() && geteuid() == 0)) {
  /* ... */
}

Risk Assessment

Automated Detection

Tool	Version	Checker	Description
Astrée			Supported, but no explicit checker
CodeSonar		LANG.TYPE.IOT	Inappropriate operand type
Coverity		CONSTANT_EXPRESSION_RESULT	Partially implemented
Klocwork		MISRA.LOGIC.OPERATOR.NOT_BOOL
LDRA tool suite		136 S	Fully Implemented
Parasoft C/C++test		MISRA2004-12_6_{a,b}	Fully implemented
PRQA QA-C		3344,4502
Cppcheck		cert.py	Detected by the addon cert.py
PRQA CA-C++	4.2	3709

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-480 and EXP46-C

Intersection( EXP45-C, EXP46-C) = Ø CWE-480 = Union( EXP46-C, list) where list =

• Usage of incorrect operator besides s/&/&&/ or s/|/||/

Bibliography