Page History

...

char msg[100];

void hello_message()
{
  char msg[80] = "Hello";
  strcpy(msg, "Error");
}

printf("%s\n", msg);

Compliant Solution

This compliant solution uses different, more descriptive variable names.

char error_msg[100];

void hello_message()
{
  char hello_msg[80] = "Hello";
  strcpy(error_msg, "Error");
}

printf("%s\n", error_msg);

Exceptions

When the block is small, the danger of reusing variable names is mitigated by the visibility of the immediate declaration. Even in this case, however, variable name reuse is not desirable.

Risk Assessment

Reusing a variable name in a sub-scope can lead to unintended values for the variable.

Examples of vulnerabilities resulting from the violation of this rule recommendation can be found on the
CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 5.2.4.1, "Translation limits"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 5.2