Page History

Two consecutive question marks signify the start of a trigraph sequence. According to the C99 Standard C standard [ISO/IEC 9899:19992011]

All occurrences in a source file of the following sequences of three characters (that is, trigraph sequences) are replaced with the corresponding single character.

??=	#		??)	]		??!	|
??(	[		??'	^		??>	}
??/	\		??<	{		??-	~

 

Noncompliant Code Example

...

// what is the value of a now??/
a++;

...

// what is the value of a now? ?/
a++;

...

size_t i = /* some initial value */;
if (i > 9000) {
   if (puts("Over 9000!??!") == EOF) {
     /* Handle Error */
   }
}

This example prints Over 9000!| if a C99C-compliant compiler is used.

...

size_t i = /* some initial value */;
/* assignment of i */
if (i > 9000) {
   if (puts("Over 9000!?""?!") == EOF) {
     /* Handle Error */
   }
}

...

Inadvertent trigraphs can result in unexpected behavior. Some compilers provide options to warn when trigraphs are encountered or to disable trigraph expansion. Use the warning options and ensure your code compiles cleanly. (See recommendation MSC00-C. Compile cleanly at high warning levels.)

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT C++ Secure Coding Standard: PRE07-CPP. Avoid using repeated question marks

ISO/IEC 9899:19992011 Section 5.2.1.1, "Trigraph sequences"

...