Use of Incorrect Operator
Weakness ID: 480 (Weakness Base)Status: Draft
+ Description

Description Summary

The programmer accidentally uses the wrong operator, which changes the application logic in security-relevant ways.
+ Time of Introduction
  • Implementation
+ Applicable Platforms

Languages

C: (Sometimes)

C++: (Sometimes)

Perl: (Sometimes)

All

+ Likelihood of Exploit

Low

+ Demonstrative Examples

Example 1

Example Language: C 
char foo;
foo=a+c;
+ Potential Mitigations

Pre-design through Build: Most static analysis programs should be able to catch these errors.

Phase: Implementation

Save an index variable. This is the recommended solution. Rather than subtract pointers from one another, use an index variable of the same size as the pointers in question. Use this variable to "walk" from one pointer to the other and calculate the difference. Always sanity check this number.

+ Other Notes

These types of bugs generally are the result of a typo. Although most of them can easily be found when testing of the program, it is important that one correct these problems, since they almost certainly will break the code.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory569Expression Issues
Development Concepts (primary)699
ChildOfWeakness ClassWeakness Class670Always-Incorrect Control Flow Implementation
Research Concepts (primary)1000
ChildOfCategoryCategory747CERT C Secure Coding Section 49 - Miscellaneous (MSC)
Weaknesses Addressed by the CERT C Secure Coding Standard (primary)734
ParentOfWeakness VariantWeakness Variant481Assigning instead of Comparing
Development Concepts699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness Variant482Comparing instead of Assigning
Development Concepts699
Research Concepts (primary)1000
ParentOfWeakness VariantWeakness Variant597Use of Wrong Operator in String Comparison
Development Concepts699
Research Concepts1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CLASPUsing the wrong operator
CERT C Secure CodingMSC02-CAvoid errors of omission
CERT C Secure CodingMSC03-CAvoid errors of addition
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
CLASPExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Applicable Platforms, Relationships, Other Notes, Taxonomy Mappings
2008-10-14CWE Content TeamMITREInternal
updated Relationships
2008-11-24CWE Content TeamMITREInternal
updated Relationships, Taxonomy Mappings
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Using the Wrong Operator
Back to top