Page History

Macro replacement lists should be parenthesized to protect any lower-precedence operators from the surrounding expression. See also PRE00-AC. Prefer inline or static functions to function-like macros and PRE01-AC. Use parentheses within macros around parameter names.

...

Noncompliant Code Example

This CUBE() macro definition is non-compliant noncompliant because it fails to parenthesize the replacement list.:

#define CUBE(X) (X) * (X) * (X)
int i = 3;
int a = 81 / CUBE(i);

As a result, the invocation

int a = 81 / CUBE(i);

expands to

int a = 81 / i * i * i;

which evaluates as

int a = ((81 / i) * i) * i);  /* evaluatesEvaluates to 243 */

which is not the desired behavior.

Compliant Solution

With its replacement list parenthesized, the CUBE() macro expands correctly for this type of invocation.

#define CUBE(X) ((X) * (X) * (X))
int i = 3;
int a = 81 / CUBE(i);

This compliant solution violates PRE00-AC. Prefer inline or static functions to function-like macros. Consequently, this solution would be better implemented as an inline function.

...

Noncompliant Code Example

In this non-compliant noncompliant code example, EOF END_OF_FILE is defined as -1. The macro replacement list consists of a unary negation operator '-' followed by an integer literal ' 1'.:

#define EOFEND_OF_FILE -1
/* ... */
if (getchar() EOFEND_OF_FILE) {
   /* ... */
}

In this example, the programmer has mistakenly omitted the comparison operator (see MSC02-A. Avoid errors of omission) from the conditional statement, which should be getchar() != EOF. END_OF_FILE. (See void MSC02-C. Avoid errors of omission.) After macro expansion, the conditional expression is incorrectly evaluated as a binary operation: getchar()-1. This statement is syntactically correct, even though it is certainly not what the programmer intended. Note that this example also violates DCL00-AC. Const-qualify immutable objects.

Parenthesizing the -1 in the declaration of EOF END_OF_FILE ensures that the macro expansion is evaluated correctly.:

#define EOFEND_OF_FILE (-1)

Once this modification is made, the non-compliant noncompliant code example no longer compiles because the macro expansion results in the conditional expression getchar() (-1), which is no longer syntactically valid. Note that there must be a space after EOF END_OF_FILE because, otherwise, it becomes a function-like macro (and one that is incorrectly formed , because -1 −1 cannot be a formal parameter).

Compliant Solution

In this compliant solution, the macro definition is replaced with an enumeration constant in compliance with DCL00-AC. Const-qualify immutable objects. In addition, because EOF is a reserved macro defined in the <stdio.h> header, the compliant solution must also use a different indentifier in order to comply with DCL37-C. Do not declare or define a reserved identifier.

enum { EOFEND_OF_FILE = -1 };
/* ... */
if (getchar() != EOFEND_OF_FILE) {
   /* ... */
}

Exceptions

PRE02-C-EX1. : A macro that expands to a single identifier or function call is not affected by the precedence of any operators in the surrounding expression, so its replacement list need not be parenthesized.

#define MY_PID getpid()

PRE02-C-EX2: A macro that expands to an array reference using the array-subscript operator [], or an expression designating a member of a structure or union object using either the member-access . or -> operators is not affected by the precedence of any operators in the surrounding expression, so its replacement list need not be parenthesized.

#define NEXT_FREE block->next_free
#define CID customer_record.account.cid
#define TOOFAR array[MAX_ARRAY_SIZE]

Risk Assessment

Failing to parenthesize macro replacement lists can cause unexpected results.

Automated Detection

...

Tool	Version	Checker	Description
Axivion Bauhaus Suite	Include Page Axivion Bauhaus Suite_V Axivion Bauhaus Suite_V	CertC-PRE02
CodeSonar	Include Page CodeSonar_V CodeSonar_V	LANG.PREPROC.MACROEND LANG.PREPROC.MACROSTART	Macro Does Not End With ) or } Macro Does Not Start With ( or {
ECLAIR	Include Page ECLAIR_V ECLAIR_V	CC2.PRE02	Fully implemented
Helix QAC	Include Page Helix QAC_V Helix QAC_V	C3409
Klocwork	Include Page Klocwork_V Klocwork_V	MISRA.DEFINE.BADEXP
LDRA tool suite	Include Page LDRA_V LDRA_V	77 S	Fully implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-PRE02-a	Enclose in parentheses whole definition of a function-like macro
PC-lint Plus	Include Page PC-lint Plus_V PC-lint Plus_V	773, 973	Fully supported

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 6.10, "Preprocessing directives," and Section 5.1.1, "Translation environment"
\[[ISO/IEC PDTR 24772|AA. C References#ISO/IEC PDTR 24772]\] "JCW Operator precedence/Order of Evaluation", "NMP Pre-processor Directions"
\[[Plum 85|AA. C References#Plum 85]\] Rule 1-1
\[[Summit 05|AA. C References#Summit 05]\] Question 10.1

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedPRE01-A. Use parentheses within macros around parameter names      Edit       PRE03-A. Prefer typedefs to defines for encoding types