1652
returnROI = currentValue - initialInvestment / initialInvestment;
return returnROI;
}
However, the return on investment calculation will not produce correct results because of the
incorrect operator precedence logic in the equation. The divide operator has a higher precedence
than the minus operator, therefore the equation will divide the initial investment costs by the
initial investment costs which will only subtract one from the current value. Again this operator
precedence logic error can be resolved by the correct use of parentheses within the equation, as
shown below.
Example Language: Java (Good)
...
returnROI = (currentValue - initialInvestment) / initialInvestment;
...
Note that the initialInvestment variable in this example should be validated to ensure that it is
greater than zero to avoid a potential divide by zero error (CWE-369).
Observed Examples
Reference Description
CVE-2008-2516 Authentication module allows authentication bypass because it uses "(x =
call(args) == SUCCESS)" instead of "((x = call(args)) == SUCCESS)".
https://www.cve.org/CVERecord?id=CVE-2008-2516
CVE-2008-0599 Chain: Language interpreter calculates wrong buffer size (CWE-131) by using
"size = ptr ? X : Y" instead of "size = (ptr ? X : Y)" expression.
https://www.cve.org/CVERecord?id=CVE-2008-0599
CVE-2001-1155 Chain: product does not properly check the result of a reverse DNS lookup
because of operator precedence (CWE-783), allowing bypass of DNS-based
access restrictions.
https://www.cve.org/CVERecord?id=CVE-2001-1155
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 737 CERT C Secure Coding Standard (2008) Chapter 4 -
Expressions (EXP)
734 2341
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1181 SEI CERT Perl Coding Standard - Guidelines 03.
Expressions (EXP)
1178 2466
MemberOf 1307 CISQ Quality Measures - Maintainability 1305 2484
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding EXP00-C Exact Use parentheses for precedence of
operation
SEI CERT Perl Coding
Standard
EXP04-
PL
CWE More
Abstract
Do not mix the early-precedence logical
operators with late-precedence logical
operators
CWE Version 4.14
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-784: Reliance on Cookies without Validation
and Integrity Checking in a Security Decision