The PORTING checkers identify code that might rely on specific implementation details in different compilers. The PORTING.CMPSPEC.EFFECTS.ASSIGNMENT checker detects an assignment in a function parameter.

Vulnerability and risk

Order of evaluation is not defined by the C standard, so using a syntax shortcut can have significant operational impact when code is ported between different compilers. This checker detects situations in which assignment is made as part of a function call's parameter list. This assignment isn't always guaranteed to happen before the function call is made, resulting in different results on different platforms.

Mitigation and prevention

Don't use syntax shortcuts of this type, especially when there's a chance of the code being ported to a different compiler.

Vulnerable code example


1   extern bar(int*, int);

2   void foo()
3   {
4     int x, y;

5       x = 32;
6       bar(&x, y = x / 2);    // PORTING.CMPSPEC.EFFECTS.ASSIGNMENTS
7   }

Because the C standard doesn't define the evaluation order of function call parameters, different compilers could choose to evaluate 'y' as having the value of 'x' either before or after the call to function 'bar'. In this case, completely different behavior could result, depending on the compiler.

Fixed code example


2   extern bar(int*, int);

3   void foo()
4   {
5     int x, y;

6       x = 32;
7       y = x / 2;
8       bar(&x, y);
9   }

In the fixed example, the short cut is avoided, ensuring that we know how the code will execute on different platforms.