| Wiki Markup |
|---|
Parenthesize all variable names in macro definitions. See also \[[PRE00-A. Prefer inline functions to macros]\] and \[[PRE02-A. Macro expansion should always be parenthesized for function-like macros]\]. |
Non-Compliant Code Example
This CUBE() macro definition is non-compliant because it fails to parenthesize the variable names.
| Code Block | ||
|---|---|---|
| ||
#define CUBE(I) (I * I * I) int a = 81 / CUBE(2 + 1); |
As a result, the invocation
| Code Block | ||
|---|---|---|
| ||
int a = 81 / CUBE(2 + 1); |
expands to
| Code Block | ||
|---|---|---|
| ||
int a = 81 / (2 + 1 * 2 + 1 * 2 + 1); /* evaluates to 11 */ |
Which is clearly not the desired result.
Compliant Solution
Parenthesizing all variable names in the CUBE() macro allows it to expand correctly (when invoked in this manner).
| Code Block | ||
|---|---|---|
| ||
#define CUBE(I) ( (I) * (I) * (I) ) int a = 81 / CUBE(2 + 1); |
Risk Assessment
Failing to parenthesize around the variable names within a macro can result in unintended program behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
PRE01-A | 1 (low) | 1 (unlikely) | 3 (low) | P3 | L3 |
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Summit 05|AA. C References#Summit 05]\] Question 10.1 \[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.10, "Preprocessing directives," and Section 5.1.1, "Translation environment" |