Page History

The macro expansion must always Macro replacement lists should be parenthesized to protect any lower-precedence operators from the surrounding expression.

...

. See also PRE00-C. Prefer inline or static functions to function-like macros and PRE01-C. Use parentheses within macros around parameter names.

Noncompliant Code Example

This PRODUCT CUBE() macro definition is non-compliant noncompliant because it fails to parethesize the macro expansion.parenthesize the replacement list:

#define CUBE(X) (X) * (X

#define PRODUCT(A,B) (A) * (BX)
int i n,= m3;
int a = 181 / PRODUCT(n, m)CUBE(i);

As a result, the invocation 1 / PRODUCT(n, m)

int a = 81 / CUBE(i);

expands to

1 / n * m

(which evaluates as (1 / n) * m), while the desired behavior is clearly

1 / (n * m)

See also PRE01.

Compliant Solution

By adding parentheses around each argument, this definition of the PRODUCT() macro expands correctly.

int a = 81 / i * i * i;

which evaluates as

int a = ((81 / i) * i) * i);  /* Evaluates to 243 */

which is not the desired behavior.

Compliant Solution

With its replacement list parenthesized, the CUBE() macro expands correctly for this type of invocation.

#define CUBE(X) ((X) * (X) * (X))
int i = 3

#define PRODUCT(A,B) ( (A) * (B) )
int n, m;
int a = 81 / CUBE(i);

This compliant solution violates PRE00-C. Prefer inline or static functions to function-like macros. Consequently, this solution would be better implemented as an inline function.

Noncompliant Code Example

In this noncompliant code example, END_OF_FILE is defined as -1. The macro replacement list consists of a unary negation operator followed by an integer literal 1:

#define END_OF_FILE -1
/ PRODUCT(n, m)

However, if a parameter appears several times in the expansion, the macro may not work properly if the actual argument is an expression with side effects. Given the PRODUCT() macro above, the invocation:

PRODUCT(i+, i+);

would expand to

i++ * i++

which is undefined. This is less obvious in the case of the CUBE() macro below:

#define CUBE(X, Y, Z) ( (X) * (Y) * (Z))
int i = 3;
int a = CUBE(i++);

The CUBE() macro in this expression expands to:

int a = i++ * i++ * i++;

Which is still undefined.

References

* ... */
if (getchar() END_OF_FILE) {
   /* ... */
}

In this example, the programmer has mistakenly omitted the comparison operator from the conditional statement, which should be getchar() != END_OF_FILE. (See void MSC02-C. Avoid errors of omission.) After macro expansion, the conditional expression is incorrectly evaluated as a binary operation: getchar()-1. This statement is syntactically correct, even though it is certainly not what the programmer intended. Note that this example also violates DCL00-C. Const-qualify immutable objects.

Parenthesizing the -1 in the declaration of END_OF_FILE ensures that the macro expansion is evaluated correctly:

#define END_OF_FILE (-1)

Once this modification is made, the noncompliant code example no longer compiles because the macro expansion results in the conditional expression getchar() (-1), which is no longer syntactically valid. Note that there must be a space after END_OF_FILE because, otherwise, it becomes a function-like macro (and one that is incorrectly formed because −1 cannot be a formal parameter).

Compliant Solution

In this compliant solution, the macro definition is replaced with an enumeration constant in compliance with DCL00-C. Const-qualify immutable objects. In addition, because EOF is a reserved macro defined in the <stdio.h> header, the compliant solution must also use a different indentifier in order to comply with DCL37-C. Do not declare or define a reserved identifier.

enum { END_OF_FILE = -1 };
/* ... */
if (getchar() != END_OF_FILE) {
   /* ... */
}

Exceptions

PRE02-C-EX1: A macro that expands to a single identifier or function call is not affected by the precedence of any operators in the surrounding expression, so its replacement list need not be parenthesized.

#define MY_PID getpid()

PRE02-C-EX2: A macro that expands to an array reference using the array-subscript operator [], or an expression designating a member of a structure or union object using either the member-access . or -> operators is not affected by the precedence of any operators in the surrounding expression, so its replacement list need not be parenthesized.

#define NEXT_FREE block->next_free
#define CID customer_record.account.cid
#define TOOFAR array[MAX_ARRAY_SIZE]

Risk Assessment

Failing to parenthesize macro replacement lists can cause unexpected results.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Added Image Added Image Addedcomp.lang.c FAQ list - Question 10.1