Page History

Code that has no effect or is never executed (that is, dead or unreachable code) is typically the result of a coding error and can cause unexpected behavior. Such code is usually optimized out of a program during compilation. However, to improve readability and ensure that logic errors are resolved, it should be identified, understood, and eliminated.

executed but does not perform any action, or has an unintended effect can result in unexpected behavior and vulnerabilities. Statements or expressions that have no effect should be identified and removed from code. Most modern compilers, in many cases, can warn about code that has no effect or is never executed. (See MSC00-C. Compile cleanly at high warning levels.

Non-Compliant Code Example 1

) 

Noncompliant Code Example

This noncompliant code example demonstrates how dead code can be introduced into a program [Fortify 2006]. The second conditional statement, if (s), will never evaluate true because it requires that s not be assigned NULL, and the only path where s can be assigned a non-null value ends with a return statement.

int func(int condition) {
    char *s = NULL;
    if (condition) {
        s = (char *)malloc(10);
        if (s == NULL) {
           /* Handle Error */
        }
        /* Process s */
        return 0;
    }
    /* Code that doesn't touch s */
    if (s) {
        /* This code is unreachable */
    }
    return 0;
}

Compliant Solution

Remediation of dead code requires the programmer to determine why the code is never executed and then to resolve the situation appropriately. To correct the preceding noncompliant code, the return is removed from the body of the first conditional statement.

int func(int condition) {
    char *s = NULL;
    if (condition) {
        s = (char *)malloc(10);
        if (s == NULL) {
           /* Handle error */
        }
        /* Process s */
    }
    /* Code that doesn't touch s */
    if (s) {
        /* This code is now reachable */
    }
    return 0;
}

Noncompliant Code Example

In this example, the strlen() function is used to limit the number of times the function s_loop() will iterate. The conditional statement inside the loop evaluates to true when the current character in the string is the null terminator. However, because strlen() returns the number of characters that precede the null terminator, the conditional statement never evaluates true.

int s_loop(char *s) {
    size_t i;
    size_t len = strlen(s);
    for (i=0; i < len; i++) {
        /* Code that doesn't change s, i, or len */
	  if (s[i] == '\0') {
	    /* This code is never reached */
      }
    }
    return 0;
}

Compliant Solution

Removing the dead code depends on the intent of the programmer. Assuming the intent is to flag and process the last character before the null terminator, the conditional is adjusted to correctly determine if the i refers to the index of the last character before the null terminator.

int s_loop(char *s) {
    size_t i;
    size_t len = strlen(s);
    for (i=0; i < len; i++) {
        /* Code that doesn't change s, i, or len */
	  if (s[i+1] == '\0') {
	    /* This code is now reached */
      }
    }
    return 0;
}

Noncompliant Code Example (Assignment)

In this noncompliant code In this example, the comparison of a to b has no effect.:

int a;
int b;
/* ... */
a == b;

This is code is likely a case of the programmer mistakenly using the equals operator == instead of the assignment operator =.

Compliant Solution

...

(Assignment)

The assignment of b to a is now properly performed.:

int a;
int b;
/* ... */
a = b;

...

Noncompliant Code Example

...

(Dereference)

In this example, p is incremented a pointer increment and then dereferenced, However, *p a dereference occur, but the dereference has no effect.:

int *p;
/* ... */
*p++;

Compliant Solution

...

(Dereference)

Correcting this example depends on the intent of the programmer. For instanceexample, if dereferencing p was done on accidenta mistake, then p should not be dereferenced.

int *p;
/* ... */
++p;

If the intent was to increment the value referred to by p, then parentheses can be used to ensure p is dereferenced and then incremented. (See EXP00-C. Use parentheses for precedence of operation.)

int *p;
/* ... */
(*p)++;

If the intent was to increment the value referred to by {{p}}, then parentheses can be used to ensure {{p}} is dereferenced then incremented \[[EXP00-A. Use parentheses for precedence of operation]\].

int *p;
/* ... */
(*p)++

Another possibility is that p is being used to reference a memory-mapped device. In this case, the variable p should be declared as volatile.

volatile int *p;
/* ... */
(void) *(p++);

Noncompliant Code Example (if/else if)

A chain of if/else if statements is evaluated from top to bottom. At most, only one branch of the chain will be executed: the first one with a condition that evaluates to true. Consequently, duplicating a condition in a sequence of if/else if statements automatically leads to dead code.

if (param == 1)
   openWindow();
 else if (param == 2)
   closeWindow();
 else if (param == 1) /* Duplicated condition */
   moveWindowToTheBackground();

Note that duplicating a condition violates this guideline only if the duplicate conditions always behave similarly...see a compliant solution below for a condition that is textually a duplicate but behaves differently.

Compliant Solution (if/else if)

In this compliant solution, the third conditional expression has been corrected.

if (param == 1)
   openWindow();
 else if (param == 2)
   closeWindow();
 else if (param == 3)
   moveWindowToTheBackground();

Compliant Solution (Conditional Side-Effects)

This code does not violate this recommendation, because even though the conditions are textually identical, they have different side effects, because the getc()  function advances the stream marker.

if (getc() == ':')
   readMoreInput();
 else if (getc() == ':')
   readMoreInput();
 else if (getc() == ':')
   readMoreInput();

Noncompliant Code Example (logical operators)

Using the same subexpression on either side of a logical operator is almost always a mistake.  In this noncompliant code example, the rightmost subexpression of the controlling expression of each if statement has no effect.  

if (a == b && a == b) { // if the first one is true, the second one is too
  do_x();
}
if (a == c || a == c ) { // if the first one is true, the second one is too
  do_w();
}

Compliant Solution (logical operators)

In this compliant solution, the rightmost subexpression of the controlling expression of each if statement has been removed.

if (a == b) { 
  do_x();
}
if (a == c) { 
  do_w();
}

Noncompliant Code Example (Unconditional Jump)

Unconditional jump statements typically has no effect.  

#include <stdio.h>
 
for (int i = 0; i < 10; ++i) {
  printf("i is %d", i);
  continue;  // this is meaningless; the loop would continue anyway
}

Compliant Solution (Unconditional Jump)

The continue statement has been removed from this compliant solution.

#include <stdio.h>
 
for (int i = 0; i < 10; ++i) {
   printf("i is %d", i); 
}

Exceptions

typedef enum { Red, Green, Blue } Color;
const char* f(Color c) {
  switch (c) {
    case Red: return "Red";
    case Green: return "Green";
    case Blue: return "Blue";
    default: return "Unknown color";   /* Not dead code */
  }
}

void g() {
  Color unknown = (Color)123;
  puts(f(unknown));
}

Risk Assessment

The presence of code that has no effect could or is never executed can indicate logic errors that may result in unexpected behavior and vulnerabilities. Such code can be introduced into programs in a variety of ways and eliminating it can require significant analysis.

Automated Detection

...

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V	dead-assignment dead-initializer expression-result-unused redundant-operation unreachable-code unreachable-code-after-jump unused-function statement-sideeffect	Supported + partially checked
CodeSonar	Include Page CodeSonar_V CodeSonar_V	DIAG.UNEX.* LANG.STRUCT.EBS LANG.STRUCT.RC MISC.NOEFFECT LANG.STRUCT.ALIGNAS.EZA LANG.STRUCT.UC LANG.STRUCT.UA LANG.STRUCT.UULABEL LANG.STRUCT.UUMACRO LANG.STRUCT.UUPARAM LANG.STRUCT.UUTAG LANG.STRUCT.UUTYPE	Code not exercised by analysis Empty branch statement checks Redundant condition Function call has no effect Explicit Zero Alignment Unreachable code checks Useless assignment Unused Label Unused Macro Unused Parameter Unused Tag Unused Type
Coverity	Include Page Coverity_V Coverity_V	NO_EFFECT   DEADCODE   UNREACHABLE	Finds statements or expressions that do not accomplish anything

...

or statements that perform an unintended action.

...

Can detect the specific instance where code can never be reached because of a logical contradiction or a dead "default" in switch statement Can detect the instances where code block is unreachable because of the syntactic structure of the code
ECLAIR	Include Page ECLAIR_V ECLAIR_V	CC2.MSC12	Partially implemented
GCC	3.0	-Wunused-value -Wunused-parameter	Options detect unused local variables, nonconstant static variables and unused function parameters, or unreachable code respectively.
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C3110, C3112, C3307, C3404, C3426, C3427
Klocwork	Include Page Klocwork_V Klocwork_V	CWARN.NOEFFECT.SELF_ASSIGN CWARN.NOEFFECT.UCMP.GE CWARN.NOEFFECT.UCMP.GE.MACRO CWARN.NOEFFECT.UCMP.LT CWARN.NOEFFECT.UCMP.LT.MACRO CWARN.NULLCHECK.FUNCNAME EFFECT MISRA.STMT.NO_EFFECT UNREACH.GEN UNREACH.RETURN UNREACH.SIZEOF UNREACH.ENUM LA_UNUSED VA_UNUSED.GEN VA_UNUSED.INIT INVARIANT_CONDITION.UNREACH
LDRA tool suite	Include Page LDRA_V LDRA_V	8 D, 65 D, 105 D, I J, 139 S, 140 S, 57 S	Partially implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-MSC12-a CERT_C-MSC12-b CERT_C-MSC12-c CERT_C-MSC12-d CERT_C-MSC12-e CERT_C-MSC12-f CERT_C-MSC12-g CERT_C-MSC12-h CERT_C-MSC12-i CERT_C-MSC12-j CERT_C-MSC12-k	There shall be no unreachable code in "else" block There shall be no unreachable code after 'return', 'break', 'continue', and 'goto' statements There shall be no unreachable code in "if/else/while/for" block There shall be no unreachable code in switch statement There shall be no unreachable code in 'for' loop There shall be no unreachable code after 'if' or 'switch' statement There shall be no unreachable code after "if" or "switch" statement inside while/for/do...while loop Avoid switch with unreachable branches Avoid unreachable methods Avoid conditions that always evaluate to the same value All non-null statements shall either have at least one side-effect however executed or cause control flow to change
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	438, 474, 505, 522, 523, 527, 528, 529, 563, 612, 714, 715, 719, 749, 750, 751, 752, 753, 754, 755, 756, 757, 758, 768, 769, 774, 827, 838, 1972	Fully supported
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rec. MSC12-C	Checks for: Unreachable code Dead code Rec. partially covered.
RuleChecker	Include Page RuleChecker_V RuleChecker_V	dead-assignment dead-initializer expression-result-unused redundant-operation unreachable-code-after-jump unused-function statement-sideeffect	Partially checked
SonarQube C/C++ Plugin	Include Page SonarQube C/C++ Plugin_V SonarQube C/C++ Plugin_V	S1764, S2589, S2583, S1116, S1172, S1763, S1862, S1065, S1656, S2754, S1751
Splint	Include Page Splint_V Splint_V	-standard	The default mode checks for unreachable code.
PVS-Studio	Include Page PVS-Studio_V PVS-Studio_V	V551, V606, V649, V779

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Coverity 07 Coverity Prevent? User's Manual (3.3.0) (2007).

CVE-2014-1266 results from a violation of this rule. There is a spurious goto fail statement on line 631 of sslKeyExchange.c. This goto statement gets executed unconditionally, even though it is indented as if it were part of the preceding if statement. As a result, the call to sslRawVerify() (which would perform the actual signature verification) becomes dead code [ImperialViolet 2014].

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedMSC11-A. Incorporate diagnostic tests using assertions      14. Miscellaneous (MSC)       MSC13-A. Detect and remove unused values