According to ISO/IEC 9899:TC3the C standard, Section 7.1.3 on reserved identifiers[ISO/IEC 9899:2011],
- All identifiers that begin with an underscore and either an uppercase letter or another underscore are always reserved for any use.
- All identifiers that begin with an underscore are always reserved for use as identifiers with file scope in both the ordinary and tag name spaces.
- Each macro name in any of the following subclauses (including the future library directions) is reserved for use as specified if any of its associated headers is included, unless explicitly stated otherwise.
- All identifiers with external linkage (including future library directions) and
errno
are always reserved for use as identifiers with external linkage.- Each identifier with file scope listed in any of the above following subclauses (including the future library directions) is reserved for use as a macro name and as an identifier with file scope in the same name space if any of its associated headers is included.
No other identifiers are reserved #1. . (Note that the POSIX® standard extends the set of identifiers reserved by the C standard to include an open-ended set of its own. See section 2.2 Compilation Environment in IEEE Std 1003.1-2008.) The behavior of a program that declares or defines an identifier in a context in which it is reserved, or defines a reserved identifier as a macro name, is undefined. See also undefined behavior 100 of 106 in Annex J of C99the C standard. Trying to define a reserved identifier can result in its name conflicting with that used in implementation, which may or may not be detected at compile time. Anchor
Noncompliant Code Example (Header Guard)
A common but noncompliant practice is to choose a reserved name for a macro used in a preprocessor conditional guarding against multiple inclusion of a header file. See also recommendation PRE06-C. Enclose header files in an inclusion guard. The name may clash with reserved names defined by the implementation of the C standard library in its headers , or with reserved names implicitly predefined by the compiler , even when no C standard library header is included. A typical manifestation of such a clash is a compilation error.
Code Block | ||||
---|---|---|---|---|
| ||||
#ifndef _MY_HEADER_H_
#define _MY_HEADER_H_
/* contents of <my_header.h> */
#endif /* _MY_HEADER_H_ */
|
...
Code Block | ||||
---|---|---|---|---|
| ||||
#ifndef MY_HEADER_H
#define MY_HEADER_H
/* contents of <my_header.h> */
#endif /* MY_HEADER_H */
|
...
In this noncompliant code example, the names of the file scope objects _max_limit
and _limit
both begin with an underscore. Since it is static
, the declaration of _max_limit
might seem to be impervious to clashes with names defined by the implementation. However, because the header <stddef.h>
is included to define size_t
, a potential for a name clash exists. (Note, however, that a conforming compiler may implicitly declare reserved names regardless of whether or not any C standard library header has been explicitly included.) In addition, because _limit
has external linkage, it may clash with a symbol with the same name defined in the language runtime library , even if such a symbol is not declared in any header. Consequently, it is unsafe to start the name of any file scope identifier with an underscore , even if its linkage limits its visibility to a single translation unit. Common effects of such clashes range from compiler errors , to linker errors , to abnormal program behavior at runtime.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stddef.h> /* for size_t */
static const size_t _max_limit = 1024;
size_t _limit = 100;
unsigned int getValue(unsigned int count) {
return count < _limit ? count : _limit;
}
|
...
In this compliant solution, names of no-file-scope objects begin with an underscore and , hence , do not encroach on the reserved name space.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stddef.h> /* for size_t */
static const size_t max_limit = 1024;
size_t limit = 100;
unsigned int getValue(unsigned int count) {
return count < limit ? count : limit;
}
|
Noncompliant Code Example (Reserved Macros)
In the this noncompliant code example below, because the C standard library header <inttypes.h>
is specified to include <stdint.h>
, the name MAX_SIZE
conflicts with the name of the <stdint.h>
header macro used to denote the upper limit of size_t
. In addition, while although the name INTFAST16_LIMIT_MAX
isn't is not defined by the C standard library, it encroaches on the reserved name space because it begins with the INT
prefix and ends with the _MAX
suffix, it encroaches on the reserved name space. (See section 8Section 7.2631.8 10 of C99the C standard.) A typical manifestation of such a clash is a compilation error.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <inttypes.h> /* for int_fast16_t and PRIdFAST16 */
static const int_fast16_t INTFAST16_LIMIT_MAX = 12000;
void print_fast16(int_fast16_t val) {
enum { MAX_SIZE = 80 };
char buf [MAX_SIZE];
if (INTFAST16_LIMIT_MAX < val)
sprintf(buf, "The value is too large");
else
snprintf(buf, MAX_SIZE, "The value is %" PRIdFAST16, val);
/* ... */
}
|
Compliant Solution (Reserved Macros)
The This compliant solution below avoids redefining reserved names or using reserved prefixes and suffixes.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <inttypes.h> /* for int_fast16_t and PRIdFAST16 */
static const int_fast16_t MY_INTFAST16_UPPER_LIMIT = 12000;
void print_fast16(int_fast16_t val) {
enum { BUFSIZE = 80 };
char buf [BUFSIZE];
if (MY_INTFAST16_UPPER_LIMIT < val)
sprintf(buf, "The value is too large");
else
snprintf(buf, BUFSIZE, "The value is %" PRIdFAST16, val);
/* ... */
}
|
Noncompliant Code Example (Identifiers
...
with External Linkage)
In addition to symbols defined as functions in each C standard library header, identifiers with external linkage include, among many others, errno
, math_errhandling
, setjmp()
, and va_end()
, regardless of whether any or not any of them is masked by a macro of the same name or not.
The This noncompliant example below provides definitions for the C standard library functions malloc()
and free()
. While Although this practice is permitted by many traditional implementations of UNIX (e.g., the Dmalloc library), doing so it is disallowed by the C99 C standard because it is not generally portable and may lead to undefined behavior. Common effects range from compiler errors , to linker errors , to abnormal program behavior at runtime. In addition, even Even on systems where replacing malloc()
is allowed, doing so without also replacing calloc()
and realloc()
is likely to cause problems , as well.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stddef.h>
void* malloc(size_t nbytes) {
void *ptr;
/* allocate storage from own pool and set ptr */
return ptr;
}
void free(void *ptr) {
/* return storage to own pool */
}
|
Compliant Solution (Identifiers
...
with External Linkage)
The compliant, portable solution avoids redefining any C standard library identifiers with external linkage. In addition, it provides definitions for all memory allocation functions.
Code Block | ||||
---|---|---|---|---|
| ||||
#include <stddef.h>
void* my_malloc(size_t nbytes) {
void *ptr;
/* allocate storage from own pool and set ptr */
return ptr;
}
void* my_calloc(size_t nelems, size_t elsize) {
void *ptr;
/* allocate storage from own pool and set ptr */
return ptr;
}
void* my_realloc(void *ptr, size_t nbytes) {
/* reallocate storage from own pool and set ptr */
return ptr;
}
void my_free(void *ptr) {
/* return storage to own pool */
}
|
Noncompliant Code Example (errno
)
According [ISO/IEC 9899-1999], the The behavior of a program is undefined when
a macro definition of
errno
is suppressed in order to access an actual object, or the program defines an identifier with the nameerrno
. [ISO/IEC 9899:2011]
(See undefined behavior 108 114 of Annex J.)
The errno
identifier expands to a modifiable lvalue that has type int
but is not necessarily the identifier of an object. It might expand to a modifiable lvalue resulting from a function call, such as *errno()
. It is unspecified whether errno
is a macro or an identifier declared with external linkage. If a macro definition is suppressed to access an actual object, or a program defines an identifier with the name errno
, the behavior is undefined.
...
Code Block | ||||
---|---|---|---|---|
| ||||
extern int errno;
|
Compliant Solution (errno
)
...
Code Block | ||||
---|---|---|---|---|
| ||||
#include <errno.h>
|
Implementations conforming to C99 C are required to declare errno
in <errno.h>
, although some historic implementations failed to do so.
...
Tool | Version | Checker | Description | section||||||
---|---|---|---|---|---|---|---|---|---|
|
| section | |||||||
Compass/ROSE |
|
|
|
Related Guidelines
CERT C++ Secure Coding Standard: DCL32-CPP. Do not declare or define a reserved identifier
ISO/IEC 9899:19992011 Section 7.1.3, "Reserved Identifiers"
...
[IEEE Std 1003.1-2008] Section 2.2 "The Compilation Environmentcompilation environment"
...