The program uses an expression in which operator precedence
causes incorrect logic to be used.
Extended Description
While often just a bug, operator precedence logic errors can have serious
consequences if they are used in security-critical code, such as making an
authentication decision.
Applicable Platforms
Languages
C: (Rarely)
C++: (Rarely)
Any: (Rarely)
Modes of Introduction
Logic errors related to operator precedence may cause problems even during
normal operation, so they are probably discovered quickly during the testing
phase. If testing is incomplete or there is a strong reliance on manual
review of the code, then these errors may not be discovered before the
software is deployed.
Common Consequences
Scope
Effect
Confidentiality
Integrity
Availability
The consequences will vary based on the context surrounding the
incorrect precedence. In a security decision, integrity or
confidentiality are the most likely results. Otherwise, a crash may
occur due to the software reaching an unexpected state.
Description
