Page History

...

Consequently if two handlers catch exceptions that are derived from the same base class (such as std::exception), the most derived exception must come first.

Noncompliant Code Example

In this noncompliant code example, the first handler will catch all exceptions of class B, as well as exceptions of class D, since they are also of class B. Consequently, the second handler will not catch any exceptions.

// Classes used for exception handling.
class B {};
class D : public B {};

void f() {
  try {
    // ...
  } catch (B &b) {
    // ...
  } catch (D &d) {
    // ...
  }
}

Compliant Solution

In this compliant solution, the first handler will catch all exceptions of class D, and the second handler will catch all the other exceptions of class B.

// Classes used for exception handling.
class B {};
class D : public B {};

void f() {
  try {
    // ...
  } catch (D &d) {
    // ...
  } catch (B &b) {
    // ...
  }
}

Risk Assessment

Exception handlers with inverted priorities cause unexpected control flow when an exception occurs of the derived type.

Automated Detection

Related Vulnerabilities

Search for other vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...