If a file with the same name as a standard header is placed in the search path for included source files, the behavior is undefined.
The following table from the C Standard, subclause 7.1.2 [ISO/IEC 9899:2011], lists these standard headers:
<assert.h> |
<float.h> | <math.h> |
<stdatomic.h> |
<stdlib.h> |
<time.h> |
<complex.h> | <inttypes.h> |
<setjmp.h> | <stdbool.h> |
<stdnoreturn.h> |
<uchar.h> |
<ctype.h> |
<iso646.h> | <signal.h> |
<stddef.h> |
<string.h> |
<wchar.h> |
<errno.h> |
<limits.h> |
<stdalign.h> |
<stdint.h> | <tgmath.h> | <wctype.h> |
<fenv.h> | <locale.h> |
<stdarg.h> |
<stdio.h> |
<threads.h> |
Do not reuse standard header file names, system-specific header file names, or other header file names.
...
In this noncompliant code example, the programmer chooses to use a local version of the standard library but does not make the change clear.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include "stdio.h" /* confusingConfusing, distinct from <stdio.h> */ /* ... */ |
...
The solution addresses the problem by giving the local library a unique name (as per PRE08-C. Guarantee that header file names are unique), which makes it apparent that the library used is not the original.:
| Code Block | ||||
|---|---|---|---|---|
| ||||
/* Using a local version of stdio.h */
#include "mystdio.h"
/* ... */
|
...
Using header file names that conflict with other header file names can result in an incorrect file being included.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
PRE04-C |
Low |
Unlikely |
Medium | P2 | L3 |
Automated Detection
...
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Axivion Bauhaus Suite |
| CertC-PRE04 | |||||||
| CC2.PRE04 | Fully implemented | |||||||
| Helix QAC |
| C5001 | |||||||
| LDRA tool suite |
| 568 S | Fully implemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Other Languages
...
Related Guidelines
...
...
...
References
...
| CERT Oracle Secure Coding Standard for Java | DCL01-J. Do not reuse public identifiers from the Java Standard Library |
Bibliography
...
...
...
| 2011] | Subclause 7.1.2, |
...
| "Standard |
...
| Headers" |
...
PRE03-C. Prefer typedefs to defines for encoding types 01. Preprocessor (PRE)