CWE-482, Comparing instead of Assigning, is the mirror image of CWE-481. The code uses a comparison operator when the intent was to assign a value. MITRE lists C and C++ and notes that the two operators look close enough to be confused.
How it happens
A statement meant to set a variable instead tests it and throws the result away.
// Vulnerable: compares, does not assign
int retries;
retries == 3; /* no effect */
The line compiles in C and C++. retries keeps whatever value it had, which may be uninitialized.
What an attacker gains
MITRE lists availability and integrity impact through an unexpected state. Because the assignment never takes place, it says the problem should cause obvious program execution problems. A security variable that never gets its intended value, such as a flag or a limit, can leave a check running on stale data. The record has no observed CVEs.
How to find it
MITRE says many IDEs and static analysis products detect this, and an IDE or linter can highlight it. Compilers also warn about a statement with no effect. Enable those warnings and fail the build on them.
How to fix it
Replace the comparison with an assignment, then keep the tooling on so the next one is caught. MITRE's listed mitigation is testing with the IDEs and static analysis products that detect the issue.
retries = 3;
Quick check
Why is this usually found quickly?
The variable never changes, so the program misbehaves in plain view. Compiler warnings about statements with no effect catch it even sooner.
