Page History

...

The C Standard, 6.5, paragraph 2 [ISO/IEC 9899:20112024], states

If a side effect on a scalar object is unsequenced relative to either a different side effect on the same scalar object or a value computation using the value of the same scalar object, the behavior is undefined. If there are multiple allowable orderings of the subexpressions of an expression, the behavior is undefined if such an unsequenced side effect occurs in any of the orderings.

This requirement must be met for each allowable ordering of the subexpressions of a full expression; otherwise, the behavior is undefined. (See undefined behavior 3534.)

The following sequence points are defined in the C Standard, Annex C [ISO/IEC 9899:2011]:

• Between the evaluations of the function designator and actual arguments in a function call and the actual call
• Between the evaluations of the first and second operands of the following operators:
  • Logical AND: &&
  • Logical OR: ||
  • Comma: ,
• Between the evaluations of the first operand of the conditional ?: operator and whichever of the second and third operands is evaluated
• The end of a full declarator
• Between the evaluation of a full expression and the next full expression to be evaluated; the following are full expressions:
  • An initializer that is not part of a compound literal
  • The expression in an expression statement
  • The controlling expression of a selection statement (if or switch)
  • The controlling expression of a while or do statement
  • Each of the (optional) expressions of a for statement
  • The (optional) expression in a return statement
• Immediately before a library function returns
• After the actions associated with each formatted input/output function conversion specifier
• Immediately before and immediately after each call to a comparison function, and also between any call to a comparison function and any movement of the objects passed as arguments to that call

Furthermore, Section 6.5.17.1, paragraph 3 [ISO/IEC 9899:2024] says (regarding assignment operations):

The side effect of updating the stored value of the left operand is sequenced after the value computations of the left and right operands. 

This rule means that statements such as

...

Not all instances of a comma in C code denote a usage of the comma operator. For example, the comma between arguments in a function call is not a sequence point. However, according to the C Standard, 6.5.23.23, paragraph 10 8 [ISO/IEC 9899:20112024]

Every evaluation in the calling function (including other function calls) that is not otherwise specifically sequenced before or after the execution of the body of the called function is indeterminately sequenced with respect to the execution of the called function.

This rule means that the order of evaluation for function call arguments is unspecified and can happen in any order.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

...

Bibliography

...