Page History

For portable applications, use only the assignment = operator, the equality operators == and !=, and the unary & operator on plain-character-typed or plain-wide-character-typed expressions.

Wiki Markup

This is recommended because the C99 standard requires only the digit characters ('0' - '9') to have consecutive numerical values \[[C99 N1401]\]. Thus, operations that rely on expected values for plain character or plain wide character-typed expressions can lead to unexpected behavior.

This practice is recommended because the C Standard requires only the digit characters (0–9) to have consecutive numerical values. Consequently, operations that rely on expected values for plain-character- or plain-wide-character-typed expressions can lead to unexpected behavior.

However, because of However, due to the requirement for digit characters, the usage of other operators is allowed can be used for them according to the following restrictions:

The binary + operator may be used to add integer values from 0 to through 9 to '0'.
The binary - operator may be used to subtract character ' 0'.
Relational operators <, <=, >, and >= may can be used to check whether a character or wide character is a digit.

...

Noncompliant Code Example

The following example would seem to check This noncompliant code example attempts to determine if the value of a character variable is between 'a' and 'c' inclusive. However, since it is not required by the C99 standard that the letter characters be consecutive nor in alphabetical because the C Standard does not require the letter characters to be in consecutive or alphabetic order, the check might not work as expected.

Code Block

bgColor	#FFCCCC
lang	c


char ch = 'b';
if ((ch >= 'a') && (ch <= 'c')) {
  /* ... */
}

...

In this example, the specific check is enforced using compliant operations on character expressions.:

Code Block

bgColor	#CCCCFF
lang	c


char ch = 't';
if ((ch == 'a') || (ch == 'b') || (ch == 'c')) {
  /* ... */
}

Exceptions

STR09-C-EX1: It is ok to assume consecutive value Consecutive values for characters like a~z can be assumed on platforms where ASCII or Unicode is used. This rule is to raise awareness of recommendation is primarily concerned with platform portability, for example, such as if the code is migrated from ASCII systems to non-ASII ASCII systems.

Risk

...

Assessment

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
STR09-C

low

Low

unlikely

Unlikely

low

Low

P3

L3

Other Languages

Wiki Markup
This rule appears in the C+\+ Secure Coding Standard as \[[cplusplus:STR07-CPP. Don't assume numeric values for expressions with type plain character]\].