Page History

The C++ Standard, [reserved.names] [ISO/IEC 14882-20032014], Section 17.4.3.1.2 specifies the following sets of rules regarding reserved names:

• A translation unit that includes a standard library header shall not #define or #undef names declared in any standard library header.
• A translation unit shall not #define or #undef names lexically identical to keywords, to the identifiers listed in Table 3, or to the attribute-tokens described in 7.6.
• Each name that contains a double underscore __ or begins with an underscore followed by an uppercase letter is reserved to the implementation for any use.
• Each name that begins with an underscore is reserved to the implementation for use as a name in the global namespace.
• Each name declared as an object with external linkage in a header is reserved to the implementation to designate that library object with external linkage, both in namespace std and in the global namespace.
• Each global function signature declared with external linkage in a header is reserved to the implementation to designate that function signature with external linkage.
• Each name from the Standard C library declared with external linkage is reserved to the implementation for use as a name with extern "C" linkage, both in namespace std and in the global namespace.
• Each function signature from the Standard C library declared with external linkage is reserved to the implementation for use as a function signature with both extern "C" and extern "C++" linkage, or as a name of namespace scope in the global namespace.
• For each type T from the Standard C library, the types ::T and std::T are reserved to the implementation and, when defined, ::T shall be identical to std::T.
• A translation unit that includes a standard library header shall not #define or #undef names declared in any standard library header.

In addition, the C99 Standard [ISO/IEC 9899:1999], largely subsumed by C++, specifies in section 7.1.3 the following sets of reserved names:

...

• Literal suffix identifiers that do not start with an underscore are reserved for future standardization.

The identifiers and attribute names referred to in the preceding excerpt are override, final, alignas, carries_dependency, deprecated, and noreturn.

No other identifiers are reserved ^#1. The behavior of a program that declares or defines . Declaring or defining an identifier in a context in which it is reserved or defines a reserved identifier as a macro name, is undefined . Trying to define a reserved identifier can result in its name conflicting with that used in implementation, which may or may not be detected at compile time. Anchor11 [1] Note that the POSIX ^® standard extends the set of identifiers reserved by C99 to include an open-ended set of its own. See section 2.2 Compilation Environment in [IEEE Std 1003.1-2008].results in undefined behavior. Do not declare or define a reserved identifier.

Noncompliant Code Example (Header Guard)

A common but noncompliant practice is to choose a reserved name for use a macro used in a preprocessor conditional guarding that guards against multiple inclusion inclusions of a header file. See also PRE06-CPP. Enclose header files in an inclusion guard. The While this is a recommended practice, many programs use reserved names as the header guards. Such a name may clash with reserved names defined by the implementation of the C++ standard template library in its headers , or with reserved names implicitly predefined by the compiler even when no C++ standard library header is included. A typical manifestation of such a clash is a compilation error.

#ifndef _MY_HEADER_H_
#define _MY_HEADER_H_

// contentsContents of <my_header.h>

#endif // _MY_HEADER_H_

Compliant Solution (Header Guard)

This compliant solution avoids using leading or trailing underscores in the name of the header guard.

#ifndef MY_HEADER_H
#define MY_HEADER_H

// contentsContents of <my_header.h>

#endif // MY_HEADER_H

Noncompliant Code Example (User-Defined Literal)

In this noncompliant code example, a user-defined literal operator"" x is declared. However, literal suffix identifiers are required to start with an underscore; literal suffixes without the underscore prefix are reserved for future library implementations.

#include <cstddef>
 
unsigned int operator"" x(const char *, std::size_t);

Compliant Solution (User-Defined Literal)

In this compliant solution, the user-defined literal is named operator"" _x, which is not a reserved identifier.

#include <cstddef>
 
unsigned int operator"" _x(const char *, std::size_t);

The name of the user-defined literal is operator"" _x and not _x, which would have otherwise been reserved for the global namespace.

Noncompliant Code Example (File Scope Objects)

In this noncompliant code example, the names of the file scope objects _max_limit and _limit both begin with an underscore. Since Because it is static, the declaration of _max_limit might seem to be impervious to clashes with names defined by the implementation. However, because the header <stddef.h> <cstddef> is included to define std::size_t, a potential for a name clash exists. (noteNote, however, that a conforming compiler may implicitly declare reserved names regardless of whether or not any C++ standard template library header has been explicitly included.) . In addition, because _limit has external linkage, it may clash with a symbol with the same name defined in the language runtime library even if such a symbol is not declared in any header. Consequently, it is unsafe to start the name of any file scope identifier with an underscore , even if its linkage limits its visibility to a single translation unit. Common effects of such clashes range from compiler errors, to linker errors, to abnormal program behavior at runtime.

#include <cstddef>   // std::for size_t

static const std::size_t _max_limit = 1024;
std::size_t _limit = 100;

unsigned int getValueget_value(unsigned int count) {
  return count < _limit ? count : _limit;
}

Compliant Solution (File Scope Objects)

In this compliant solution, names of no file scope objects identifiers do not begin with an underscore and, hence, do not encroach on the reserved name space.

#include <cstddef>   // for size_t

static const std::size_t max_limit = 1024;
std::size_t limit = 100;

unsigned int getValueget_value(unsigned int count) {
  return count < limit ? count : limit;
}

Noncompliant Code Example (Reserved Macros)

In the this noncompliant code example below, because the C++ standard template library header <inttypes.h> <cinttypes> is specified to include <stdint.h> <cstdint>, as per [c.files] paragraph 4 [ISO/IEC 14882-2014], the name MAX_SIZE conflicts with the name of the <stdint.h> <cstdint> header macro used to denote the upper limit of size_t. In addition, while the name INTFAST16_LIMIT_MAX isn't defined by the C standard library, because it begins with the INT prefix and ends with the _MAX suffix it encroaches on the reserved name space (see section 8.26.8 of C99). A typical manifestation of such a clash is a compilation error. std:size_t.

#include <inttypes.h><cinttypes>   // for int_fast16_t and PRIdFAST16

static const int_fast16_t INTFAST16_LIMIT_MAX = 12000;

void print_fast16(f(std::int_fast16_t val) {
    enum { MAX_SIZE = 80 };
    char buf [MAX_SIZE];
    if (INTFAST16_LIMIT_MAX < val)
      std::sprintf(buf, "The value is too large");
    else
      std::snprintf(buf, MAX_SIZE, "The value is %" PRIdFAST16, val);
    // ...
}

Compliant Solution (Reserved Macros)

The This compliant solution below avoids redefining reserved names or using reserved prefixes and suffixes.

#include <inttypes.h>  <cinttypes> // for std::int_fast16_t and PRIdFAST16

static const int_fast16_t MY_INTFAST16_UPPER_LIMIT = 12000;

void print_fast16(f(std::int_fast16_t val) {
    enum { BUFSIZEBufferSize = 80 };
    char buf [BUFSIZE];
    if (MY_INTFAST16_UPPER_LIMIT < val)
      std::sprintf(buf, "The value is too large");
    else
      std::snprintf(buf, BUFSIZE, "The value is %" PRIdFAST16, val);
    // ...
}

Noncompliant Code Example (Identifiers With External Linkage)

In addition to symbols defined as functions in each C standard library header, identifiers with external linkage include, among many others, errno, math_errhandling, setjmp(), and va_end(), regardless of whether any of them is masked by a macro of the same name or not.

Exceptions

DCL51-CPP-EX1: For compatibility with other compiler vendors or language standard modes, it is acceptable to create a macro identifier that is the same as a reserved identifier so long as the behavior is semantically identical, as in this exampleThe noncompliant example below provides definitions for the C standard library functions std::malloc() and std::free(). While this practice is permitted by many traditional implementations of UNIX (see, for example, the Dmalloc library), doing so is disallowed by the C++ standard as it need not generally portable and may lead to undefined behavior. Common effects range from compiler errors, to linker errors, to abnormal program behavior at runtime. In addition, even on systems where replacing malloc() is allowed, doing so without also replacing std::calloc() and std::realloc() is likely to cause problems as well.

#include <cstddef>

void* malloc(std::size_t nbytes) {
  void *ptr;
  // allocateSometimes storagegenerated fromby ownconfiguration pooltools andsuch setas ptrautoconf
#define const return ptr;
}

void free(void *ptr) {
  // return storage to own pool
}

Compliant Solution (Identifiers With External Linkage)

const
 
// Allowed compilers with semantically equivalent extension behavior
#define inline __inline

DCL51-CPP-EX2: As a compiler vendor or standard library developer, it is acceptable to use identifiers reserved for your implementation. Reserved identifiers may be defined by the compiler, in standard library headers, or in headers included by a standard library header, as in this example declaration from the libc++ STL implementationThe compliant, portable solution avoids redefining any C standard library identifiers with external linkage. In addition, it provides definitions for all memory allocation functions.

#include <cstddef>

void* my_malloc(std::size_t nbytes) {
  void *ptr;
  // allocateThe storagefollowing fromdeclaration ownof poola andreserved setidentifier ptr
exists in return ptr;
}

void* my_calloc(std::size_t nelems,the libc++ implementation of
// std::sizebasic_tstring elsize)as {
a public void *ptr;
  /// allocate storage from own pool and set ptr
  return ptr;
}

void* my_realloc(void *ptr, std::size_t nbytes) {
  // reallocate storage from own pool and set ptr
  return ptr;
}

void my_free(void *ptr) member. The original source code may be found at:
// http://llvm.org/svn/llvm-project/libcxx/trunk/include/string
 
template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT>>
class basic_string {
  // return storage to own pool
}

Exceptions

DCL32-EX1: For compatibility with other compiler vendors or language standard modes, it is acceptable to create a macro identifier the same as a reserved identifier so long as the behavior is idempotent, as in this example:

// Sometimes generated by configuration tools such as autoconf
#define const const
 
// Allowed compilers with semantically equivalent extension behavior
#define inline __inline...
 
  bool __invariants() const;
};

Risk Assessment

Using reserved identifiers can lead to incorrect program operation.

Automated Detection

...

A module written in Compass/ROSE can detect violations of this rule.

Other Languages

...

Tool	Version	Checker	Description
Astrée	Include Page Astrée_V Astrée_V	reserved-identifier	Partially checked
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC++-DCL51
Clang	Include Page Clang_V Clang_V	-Wreserved-id-macro -Wuser-defined-literals	The -Wreserved-id-macro flag is not enabled by default or with -Wall, but is enabled with -Weverything. This flag does not catch all instances of this rule, such as redefining reserved names.
CodeSonar	Include Page CodeSonar_V CodeSonar_V	LANG.ID.NU.MK LANG.STRUCT.DECL.RESERVED	Macro name is C keyword Declaration of reserved name
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C++5003
Klocwork	Include Page Klocwork_V Klocwork_V	MISRA.DEFINE.WRONGNAME MISRA.DEFINE.WRONGNAME.UNDERSCORE MISRA.UNDEF.WRONGNAME MISRA.UNDEF.WRONGNAME.UNDERSCORE MISRA.STDLIB.WRONGNAME MISRA.STDLIB.WRONGNAME.UNDERSCORE
LDRA tool suite	Include Page LDRA_V LDRA_V	86 S, 218 S, 219 S, 580 S	Fully implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_CPP-DCL51-a CERT_CPP-DCL51-b CERT_CPP-DCL51-c CERT_CPP-DCL51-d CERT_CPP-DCL51-e CERT_CPP-DCL51-f	Do not #define or #undef identifiers with names which start with underscore Do not redefine reserved words Do not #define nor #undef identifier 'defined' The names of standard library macros, objects and functions shall not be reused The names of standard library macros, objects and functions shall not be reused (C90) The names of standard library macros, objects and functions shall not be reused (C99)
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C++: DCL51-CPP	Checks for redefinitions of reserved identifiers (rule partially covered)
PVS-Studio	Include Page PVS-Studio_V PVS-Studio_V	V1059
RuleChecker	Include Page RuleChecker_V RuleChecker_V	reserved-identifier	Partially checked
SonarQube C/C++ Plugin	Include Page SonarQube C/C++ Plugin_V SonarQube C/C++ Plugin_V	978

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

...

...

...

...

...

...

...

Image Modified Image Modified Image Modified