Page History

Opening and closing braces for if, for, or and while statements should always be used even if the statement's body contains only a single statement.

...

Braces also help ensure that macros with multiple statements are properly expanded. Such a macro should be wrapped in a do-while loop. (See PRE10-C. Wrap multistatement macros in a do-while loop.) However, when the do-while loop is not present, braces can still ensure that the macro expands as intended.

...

This noncompliant code example uses an if statement without braces to authenticate a user.:

int login;

if (invalid_login())
  login = 0;
else
  login = 1;

A developer might add a debugging statement to determine when the login is valid but forget to add opening and closing braces.:

int login;

if (invalid_login())
  login = 0;
else
  printf("Login is valid\n");  /* debuggingDebugging line added here */
  login = 1;                   /* thisThis line always gets executed,
                               /* regardless of a valid login! */

...

In the compliant solution, opening and closing braces are used even when the body is a single statement.:

int login;

if (invalid_login()) {
  login = 0;
} else {
  login = 1;
}

...

This noncompliant code example has an if statement nested in another if statement without braces around the if and else bodies.:

int privileges;

if (invalid_login())
  if (allow_guests())
    privileges = GUEST;
else
  privileges = ADMINISTRATOR;

...

In the compliant solution, adding braces removes the ambiguity and ensures that privileges are correctly assigned.:

int privileges;

if (invalid_login()) {
  if (allow_guests()) {
    privileges = GUEST;
  } 
} else {
  privileges = ADMINISTRATOR;
}

Noncompliant Code Example (empty block)

This noncompliant code example has a while statement with no block:

while (invalid_login());

Note that if invalid_login() has no side effects (such as warning the user if their login failed), this code also violates MSC12-C. Detect and remove code that has no effect or is never executed.

Compliant Solution (empty block)

This compliant solution features an explicit empty block, which clarifies the developer's intent:

while (invalid_login()) {}

Risk Assessment

Automated Detection

Related Vulnerabilities

CVE-2014-1266 was due, in large part, to failing to follow this recommendation. There is a spurious "goto fail" statement on line 631 of sslKeyExchange.c. This "goto" gets executed unconditionally, even though it is indented as if it were part of the preceding "if" statement.  As a result, the call to sslRawVerify (which performs the actual signature verification) is rendered dead code.  [ImperialViolet 2014]. If the body of the "if" statement had been enclosed in braces, then this defect likely would not have happened.

Related Guidelines

 Bibliography

...

...

Image Modified Image Modified Image Modified