Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Two consecutive question marks signify the start of a trigraph sequence. According to the C99 Standard C Standard, subclause 5.2.1.1 [ISO/IEC 9899:19992011],

All occurrences in a source file of the following sequences of three characters (that is, trigraph sequences) are replaced with the corresponding single character.

??=

#

 

??)

]

 

??!

|

??(

[

 

??'

^

 

??>

}

??/

\

 

??<

{

 

??-

~


Noncompliant Code Example

In this noncompliant code example, a++ is not executed because the trigraph sequence ??/ is replaced by \, logically putting a++ on the same line as the comment.:

Code Block
bgColor#FFcccc
langc

// whatWhat is the value of a now??/
a++;

Compliant Solution

The following This compliant solution eliminates the accidental introduction of the trigraph by separating the question marks.:

Code Block
bgColor#ccccFF
langc

// whatWhat is the value of a now? ?/
a++;

...

This noncompliant code example includes the trigraph sequence ??!, which is replaced by the character |.:

Code Block
bgColor#FFcccc
langc

size_t i = /* someSome initial value */;
if (i > 9000) {
   if (puts("Over 9000!??!") == EOF) {
     /* Handle Errorerror */
   }
}

This example prints Over 9000!| if a C99C-compliant compiler is used.

...

This compliant solution uses string concatenation to concatenate the two question marks; otherwise, they are interpreted as beginning a trigraph sequence.:

Code Block
bgColor#ccccFF
langc

size_t i = /* someSome initial value */;
/* assignmentAssignment of i */
if (i > 9000) {
   if (puts("Over 9000!?""?!") == EOF) {
     /* Handle Errorerror */
   }
}

The above code This code prints Over 9000!??!, as intended.

...

Inadvertent trigraphs can result in unexpected behavior. Some compilers provide options to warn when trigraphs are encountered or to disable trigraph expansion. Use the warning options, and ensure your code compiles cleanly. (See recommendation MSC00-C. Compile cleanly at high warning levels.)

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

PRE07-C

low

Low

unlikely

Unlikely

medium

Medium

P2

L3

Automated Detection

ToolVersionCheckerDescription
Section
Astrée
Include Page
Astrée_V
Astrée_V
trigraphFully checked
Axivion Bauhaus Suite
LDRA tool suite

Include Page

LDRA

Axivion Bauhaus Suite_V

LDRA Section

Axivion Bauhaus Suite_V

Section

81 S

Section

Fully Implemented

CertC-PRE07

ECLAIR

Include Page
ECLAIR_V
ECLAIR_V

CC2.PRE07

Fully implemented
Section
GCC
Include Page
GCC_V
GCC_V

 


Can detect violation of this recommendation when the -Wtrigraphs flag is used

Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C3601
LDRA tool suite
Include Page
LDRA_V
LDRA_V

81 S

Fully implemented
Parasoft C/C++test
Include Page
Parasoft_V
Parasoft_V

CERT_C-PRE07-a

Trigraphs shall not be used

PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

584, 854, 9060

Fully supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec.
SectionECLAIR
PRE07-CChecks for use of trigraphs (rec. fully covered)


RuleChecker
Include Page
ECLAIR
RuleChecker_V
ECLAIR
RuleChecker_V
Section

dtrigraf

SectionFully
trigraphFully checked
SonarQube C/C++ Plugin
Include Page
SonarQube C/C++ Plugin_V
SonarQube C/C++ Plugin_V
TrigraphUsage
Implemented

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

...

...

Bibliography

...

2011]Subclause 5.2.1.1, "Trigraph

...

Sequences"


...

Image Added Image Added

MISRA 2004 Rule 4.2

Bibliography

PRE06-C. Enclose header files in an inclusion guard      01. Preprocessor (PRE)      Image Modified