Page History

Two consecutive question marks signify the start of a trigraph sequence. According to the C Standard, subclause 5.2.1.1 [ISO/IEC 9899:2011],

All occurrences in a source file of the following sequences of three characters (

...

that is, trigraph sequences) are replaced with the corresponding single character.

??=	#		??)	]		??!	|

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="52340857-2f1b-474b-9bc0-76cf353e8fae"><ac:plain-text-body><![CDATA[

??(	[		??'	^		??>	}

...

??/	\		??<	{		??-	~

...

Noncompliant Code Example

In this non-compliant noncompliant code example, a++ will is not be executed , as because the trigraph sequence ??/ will be is replaced by \, logically putting a++ on the same line as the comment.:

// whatWhat is the value of a now??/
a++;

Compliant Solution

Trigraph sequences can be successfully used for multi-line comments.This compliant solution eliminates the accidental introduction of the trigraph by separating the question marks:

/??/
* whatWhat is the value of a now? *??/
/
a++;

...

Noncompliant Code Example

This non-compliant code has noncompliant code example includes the trigraph sequence of ??! included, which will be is replaced by the character |.:

size_t i;
 = /* assignmentSome ofinitial ivalue */;
if (i > 9000) {
   if (puts("Over 9000!??!");) == EOF) {
     /* Handle error */
   }
}

The above code will print out This example prints Over 9000!| if a C99 Compliant C-compliant compiler is used.

Compliant Solution

The This compliant solution uses string concatenation to place concatenate the two question marks together; otherwise, as they will be are interpreted as beginning a trigraph sequence otherwise.:

size_t i = /* Some initial value */;
/* assignmentAssignment of i */
if (i > 9000) {
   if (puts("Over 9000!?""?!"); == EOF) {
     /* Handle error */
   }
}

The above code will print out This code prints Over 9000!??!, as intended.

Risk Assessment

Inadvertent trigraphs can result in unexpected behavior. Some compilers provide options to warn when trigraphs are encountered or to disable trigraph expansion. Use the warning options, and ensure your code compiles cleanly. (See MSC00-C. Compile cleanly at high warning levels.)

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

...

Related Guidelines

Bibliography

...

...

...

...

Image Added Image Added Image Added sequences" \[[Wikipedia|http://en.wikipedia.org/wiki/C_trigraph]\] "C Trigraphs"