Page History

According to the C Standard, section subclause 7.1.3 [ISO/IEC 9899:2011],

...

No other identifiers are reserved. (Note that the POSIX standard extends the set of identifiers reserved by the C Standard to include an open-ended set of its own. See section 2.2, "The Compilation Environment," in IEEE Std 1003.1-2008.) The behavior of a program that declares or defines an identifier in a context in which it is reserved, or that defines a reserved identifier as a macro name, is undefined. See also undefined behavior 106  in Annex J of the C Standard. Trying to define a reserved identifier can result in its name conflicting with that used in implementation, which may or may not be detected at compile time.

...

#ifndef _MY_HEADER_H_
#define _MY_HEADER_H_

/* contentsContents of <my_header.h> */

#endif /* _MY_HEADER_H_ */

...

#ifndef MY_HEADER_H
#define MY_HEADER_H

/* contentsContents of <my_header.h> */

#endif /* MY_HEADER_H */

...

In this noncompliant code example, the names of the file scope objects _max_limit and _limit both begin with an underscore. Since Because it is static, the declaration of _max_limit might seem to be impervious to clashes with names defined by the implementation. However, because the header <stddef.h> is included to define size_t, a potential for a name clash exists. (Note, however, that a conforming compiler may implicitly declare reserved names regardless of whether any C standard library header has been is explicitly included.) In addition, because _limit has external linkage, it may clash with a symbol with the same name defined in the language runtime library even if such a symbol is not declared in any header. Consequently, it is unsafe to start the name of any file scope identifier with an underscore even if its linkage limits its visibility to a single translation unit. Common effects of such clashes range from diagnostics issued by the compiler to linker errors to abnormal program behavior at runtime.

#include <stddef.h>   /* forFor size_t */

static const size_t _max_limit = 1024;
size_t _limit = 100;

unsigned int getValue(unsigned int count) {
  return count < _limit ? count : _limit;
}

...

#include <stddef.h>   /* forFor size_t */

static const size_t max_limit = 1024;
size_t limit = 100;

unsigned int getValue(unsigned int count) {
  return count < limit ? count : limit;
}

...

In this noncompliant code example, because the C standard library header <inttypes.h> is specified to include <stdint.h>, the name MAX_SIZE conflicts with the name of the <stdint.h> header macro used to denote the upper limit of size_t. In addition, although the name INTFAST16_LIMIT_MAX is not defined by the C standard library, it encroaches on the reserved name space because it begins with the INT prefix and ends with the _MAX suffix. (See section subclause 7.31.10 of the C Standard.) A typical manifestation of such a clash is a diagnostic message issued by the compiler.

#include <inttypes.h>   /* forFor int_fast16_t and PRIdFAST16 */
#include <stdio.h>	/* forFor sprintf and snprintf */

static const int_fast16_t INTFAST16_LIMIT_MAX = 12000;

void print_fast16(int_fast16_t val) {
    enum { MAX_SIZE = 80 };
    char buf [MAX_SIZE];
    if (INTFAST16_LIMIT_MAX < val)
      sprintf(buf, "The value is too large");
    else
      snprintf(buf, MAX_SIZE, "The value is %" PRIdFAST16, val);
    /* ... */
}

Compliant Solution (Reserved Macros)

...

#include <inttypes.h>   /* forFor int_fast16_t and PRIdFAST16 */
#include <stdio.h>	/* forFor sprintf and snprintf */
 
static const int_fast16_t MY_INTFAST16_UPPER_LIMIT = 12000;

void print_fast16(int_fast16_t val) {
    enum { BUFSIZE = 80 };
    char buf [BUFSIZE];
    if (MY_INTFAST16_UPPER_LIMIT < val)
      sprintf(buf, "The value is too large");
    else
      snprintf(buf, BUFSIZE, "The value is %" PRIdFAST16, val);
    /* ... */
}

Noncompliant Code Example (Identifiers with External Linkage)

...

#include <stddef.h>	/* forFor size_t */
 
void* malloc(size_t nbytes) {
  void *ptr;
  /* allocateAllocate storage from own pool and set ptr */
  return ptr;
}

void free(void *ptr) {
  /* returnReturn storage to own pool */
}

Compliant Solution (Identifiers with External Linkage)

...

#include <stddef.h>	/* forFor size_t */

void* my_malloc(size_t nbytes) {
  void *ptr;
  /* allocateAllocate storage from own pool and set ptr */
  return ptr;
}

void* my_calloc(size_t nelems, size_t elsize) {
  void *ptr;
  /* allocateAllocate storage from own pool and set ptr */
  return ptr;
}

void* my_realloc(void *ptr, size_t nbytes) {
  /* reallocateReallocate storage from own pool and set ptr */
  return ptr;
}

void my_free(void *ptr) {
  /* returnReturn storage to own pool */
}

Noncompliant Code Example (errno)

...

a macro definition of errno is suppressed in order to access an actual object, or the program defines an identifier with the name errno. [ISO/IEC 9899:2011]

(See undefined behavior 114 in Annex J.)

The errno identifier expands to a modifiable lvalue that has type int but is not necessarily the identifier of an object. It might expand to a modifiable lvalue resulting from a function call, such as *errno(). It is unspecified whether errno is a macro or an identifier declared with external linkage. If a macro definition is suppressed to access an actual object, or if a program defines an identifier with the name errno, the behavior is undefined.

...

#include <stddef.h>	/* forFor size_t */
#include <stdlib.h>	/* generalGeneral utilities */
 
void *malloc(size_t nbytes) {  /* violationViolation */
  void *ptr;
  /* ... */
  /* allocateAllocate storage from own pool and set ptr */
  return ptr;
}
 
void free(void *ptr) {  /* violationViolation */
  /* ... */
  /* returnReturn storage to own pool */
}

Compliant Solution ( malloc(), free() )

...

#include <stddef.h>	/* forFor size_t */
 
void *malloc_custom(size_t nbytes) {  
  void *ptr;
  /* ... */
  /* allocateAllocate storage from own pool and set ptr */
  return ptr;
}
 
void free_custom(void *ptr) {  
  /* ... */
  /* returnReturn storage to own pool */
}

Exceptions

DCL37-EX1: It is permissible to use reserved words in declarations when the risk of clashing with a preexisting variable is greater than the risk of clashing with a reserved word. In particular, the scope must be used in a macro that may be invoked with arbitrary preexisting variables (possibly as arguments). The following code demonstrates a SWAP_UNSAFE() macro that exchanges two values, and uses a __tmp variable as a temporary value. This code is permitted because the temporary variable is more likely to clash with a non-reserved nonreserved variable in the current scope than with a reserved word. This code should be considered nonportable ; as because it requires the current platform to allow the use of __tmp.

#define SWAP_UNSAFE(type, a, b) {type __tmp = a; a = b; b = __tmp;}

Such macros should only be used only with great care. See rules PRE31-C. Avoid side effects in arguments to unsafe macros and PRE00-C. Prefer inline or static functions to function-like macros for more information.

...

Such code is compliant because the declaration matches what stdlib.h would provide and does not redefine the reserved identifier.   It would not be acceptable to provide a definition for the free() function in the above preceding example.

Risk Assessment

Using reserved identifiers can lead to incorrect program operation.

...

...

...

...