Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Wiki Markup
TheMacro macroreplacement expansionlists should be parenthesized to protect any lower-precedence operators from the surrounding expression.  See also \[[PRE00-A. Prefer inline functions to macros]\] and \[[PRE01-A. Use parentheses within macros around parameter names]\].

Non-Compliant Code Example

This CUBE() macro definition is non-compliant because it fails to parenthesize the macro expansionreplacement list.

Code Block
bgColor#FFcccc
#define CUBE(X) (X) * (X) * (X)
int i = 3;
int a = 81 / CUBE(i);

...

which is not the desired behavior.

Compliant Solution

By parenthesizing the macro expansionWith its replacement list parenthesized, the CUBE() macro expands correctly (when invoked in this manner)for this type of invocation.

Code Block
bgColor#ccccff
#define CUBE(X) ((X) * (X) * (X))
int i = 3;
int a = 81 / CUBE(i);

Non-Compliant Code Example

Expected Unexpected behavior resulting from macro expansion is not limited to function-like macros. This   The object-like macro definition in this example is non-compliant because the macro expansion its replacement list is not parenthesized.

Code Block
bgColor#FFcccc
#define sum a+b
/* ... */
int result = sum*4;

The value of result is a+(b*4) instead of the expected (a+b)*4.

Compliant Solution

Parenthesizing the macro replacement list yields the expected answer.

...

Note that there must be a space after sum, otherwise it becomes a function-like macro.

Exceptions

PRE02-EX1. A macro that expands to a single identifier or function call does is not change affected by the precedence of any operators in the surrounding expression, so it its replacement list need not be parenthesized.

Code Block
#define MY_PID getpid()

 Risk Assessment

Failing to parenthesize macro expansions replacement lists can result in cause unexpected results.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

PRE02-A

1 (low)

1 (unlikely)

3 (low)

P3

L3

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Wiki Markup
\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.10, "Preprocessing directives," and Section 5.1.1, "Translation environment"
\[[Summit 05|AA. C References#Summit 05]\] Question 10.1