Page History

A switch statement consists of several case labels, plus a default label. The default label is optional but recommended. (See recommendation MSC01-C. Strive for logical completeness.) A series of statements following a case label conventionally ends with a break; statement; if omitted, control flow falls through to the next case in the switch statement block. Because the break statement is not required, omitting it does not produce compiler diagnostics. If the omission was unintentional, this  it can result in an unexpected control flow.

...

In this noncompliant code example, the case where widget_type is WE_W lacks a break statement. Consequently, statements that should only be executed when widget_type is WE_X are executed even when widget_type is WE_W.

enum WidgetEnum { WE_W, WE_X, WE_Y, WE_Z } widget_type;
widget_type = WE_X;

switch (widget_type) {
  case WE_W:
    /* ... */
  case WE_X:
    /* ... */
    break;
  case WE_Y: 
  case WE_Z:
    /* ... */
    break;
  default: /* can't happen */
	 /* handle error condition */
}

...

enum WidgetEnum { WE_W, WE_X, WE_Y, WE_Z } widget_type;
widget_type = WE_X;

switch (widget_type) {
  case WE_W:
    /* ... */
    break;
  case WE_X:
    /* ... */
    break;
  case WE_Y: 
  case WE_Z:
    /* ... */
    break;
  default: /* can't happen */
	 /* handle error condition */
}

...

A break statement is not required following the default case because it would not effect affect the control flow.

Exceptions

MSC17-EX1: The last label in a switch statement requires no final break. This  It will conventionally be the default label.

...

enum WidgetEnum { WE_W, WE_X, WE_Y, WE_Z } widget_type;
widget_type = WE_X;

switch (widget_type) {
  case WE_W:
    /* ... */
    /* no break, process case for WE_X as well */
  case WE_X:
    /* ... */
    break;
  case WE_Y: case WE_Z:
    /* ... */
    break;
  default: /* can't happen */
	 /* handle error condition */
}

Risk Assessment

Failure to include break statements leads to unexpected control flow.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

The CERT Oracle Secure Coding Standard for Java: MSC55-J. Finish every set of statements associated with a case label with a break statement

...

...