Page History

Do not use the same variable name in two scopes where one scope is contained in another. Examples includeFor example,

• No other variable should share the name of a global variable if the other value variable is in a subscope of the global variable.
• A block should not declare a variable with the same name as a variable declared in any block that contains it.

Reusing variable names leads to programmer confusion about which variable is being modified. Additionally, if variable names are reused, generally one or both of the variable names are too generic.

...

Noncompliant Code Example

...

This noncompliant code example declares the msg identifier at file scope and reuses the same identifier to declare a character array local to the report_error() function. The programmer may unintentionally copy the function argument to the locally declared msg array within the report_error() function. Depending on the programmer's intention, it either fails to initialize the global variable msg or allows the local msg buffer to overflow by using the global value msgsize as a bounds for the local bufferIn this non-compliant code example, the programmer sets the value of the msg variable, expecting to reuse it outside the block. Due to the reuse of the variable name, however, the outside msg variable value is not changed.

Code Block
bgColor #FFCCCC lang c
#include <stdio.h>   static char msg[100]; /* ... */static const size_t msgsize = sizeof( msg); void report_error_message(const char *error_msgstr) { char msg[80]; snprintf(msg, msgsize, "Error: %s\n", str); /* ... */ } int strcpy(msg, error_msg);main(void) { /* error_msg is assumed to reference a NTBS of len 99 or less */... */ report_error("some error");   return 0; }

Furthermore, if the length of the null-terminated byte string referenced by error_msg is greater than 79 characters in length, a buffer overflow will occur on the stack, which may be exploitable.

Non-Compliant Code Example (strcpy_s())

In this non-compliant code example, the call to {{strpcy()}} has been replaced with a call to {{strcpy_s()}}.  See \[[STR00-A. Use TR 24731 for remediation of existing string manipulation code]\] for more information on using {{strcpy_s()}}.

Compliant Solution

This compliant solution uses different, more descriptive variable names:

#include <stdio.h>
 
static char message[100];
static const size_t message_size = sizeof( message);

void report_error(const char *str

char msg[100];
/* ... */
void error_message(char *error_msg) {
  char msg[80];
  /* ... */

  /* error_msg is assumed to reference a NTBS of length 99 or less */
  errno_t e = strcpy_ssnprintf(msg, sizeof( msg), error_msg "Error: %s\n", str);
  if (e != 0/* ... */
}

int main(void) {
  /* ...  */*
 handle strcpyreport_serror()"some error */
  }
}

This code fixes one of the two problems from the previous non-compliant code example:  it eliminates the possibility of buffer overflow because two references to {{msg}} in {{strcpy_s()}} both refer to {{msg\[80\]}} defined in the subscope. The initial problem of not changing the value of the outside {{msg}} variable value remains.   The call to {{strcpy_s()}} will also fail if the length of the null-terminated byte string referenced by {{error_msg}} is longer than 79 characters in length.

Compliant Solution

This compliant solution uses different, more descriptive variable names. Also it uses strcpy_s().

");
 
  return 0;
}

When the block is small, the danger of reusing variable names is mitigated by the visibility of the immediate declaration. Even in this case, however, variable name reuse is not desirable. In general, the larger the declarative region of an identifier, the more descriptive and verbose should be the name of the identifier.

By using different variable names globally and locally, the compiler forces the developer to be more precise and descriptive with variable names.

Noncompliant Code Example

This noncompliant code example declares two variables with the same identifier, but in slightly different scopes. The scope of the identifier i declared in the for loop's initial clause terminates after the closing curly brace of the for loop. The scope of the identifier i declared in the for loop's compound statement terminates before the closing curly brace. Thus, the inner declaration of i hides the outer declaration of i, which can lead to unintentionally referencing the wrong object.

void f(void) {
  for (int i = 0; i < 10; i++) {
    long i;
    /* ... */
  }
}

Compliant Solution

This compliant solution uses a unique identifier for the variable declared within the for loop.

void f(void) {
  for (int i = 0; i < 10; i++) {
    long j;
    /* ... */
  }
}

Exceptions

DCL01-C-EX1: A function argument in a function declaration may clash with a variable in a containing scope provided that when the function is defined, the argument has a name that clashes with no variables in any containing scopes.

extern int name;
void f(char *name);  /* Declaration: no problem here */

char system_msg[100];
/* ... */
void error_messagef(char *error_msgarg) {
  char default_msg[80];
  /* ... */
  /* Definition: no problem; arg doesn't hide name */
  /* error_msgUse is assumed to reference a NTBS of length 99 or less */
  errno_t e = strcpy_s(system_msg, sizeof(system_msg), error_msg);
  if (e != 0) {
     /* handle strcpy_s() error */
  }
}

When the block is small, the danger of reusing variable names is mitigated by the visibility of the immediate declaration. Even in this case, however, variable name reuse is not desirable.

arg */
}

DCL01-C-EX2: A temporary variable within a new scope inside of a macro can override an identifier in a containing scope. However,this exception does not apply to to the arguments of the macro itself.

#define SWAP(type, a, b) do { type tmp = a; a = b; b = tmp; } while(0)
 
void func(void) {
  int tmp = 100;
  int a = 10, b = 20;
  SWAP(int, a, b); /* Hidden redeclaration of tmp is acceptable */
  SWAP(int, tmp, b); /* NONCOMPLIANT: Hidden redeclaration of tmp clashes with argument */
}

Risk Assessment

Reusing a variable name in a subscope can lead to unintended values for the unintentionally referencing an incorrect variable.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 5.2.4.1, "Translation limits"
\[[MISRA 04|AA. C References#MISRA 04]\] Rule 5.2

Related Guidelines

...

Image Added Image Added Image AddedDCL00-A. Declare immutable values using enum or const      02. Declarations and Initialization (DCL)       DCL02-A. Use visually distinct identifiers