Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Inline functions are, in general, more suitable for this task . (See recommendation see PRE00-C. Prefer inline or static functions to function-like macros). ) Occasionally, however, they are not feasible (when macros are expected to operate on variables of different types, for example).

When multiple statements are used in a macro, they should be bound together in a do-while loop syntactically, so the macro can appear safely inside inside if clauses or other places that expect a single statement or a statement block. Note that this is only effective if none of the multiple statements are break or continue, as they would be captured by the do-while loop. (Alternatively, when an if, for, or while statement uses braces even for a single body statement, then multiple statements in a macro will expand correctly even without a do-while loop . See recommendation (see EXP19-C. Use braces for the body of an if, for, or while statement).

Noncompliant Code Example

This noncompliant code example contains multiple, unbound statements.:

Code Block
bgColor#FFcccc
langc

/*
 * Swaps two values. and requires
 * Requires tmp variable to be defined.
 */
#define SWAP(x, y) \
  tmp = x; \
  x = y; \
  y = tmp

This macro will expand expands correctly in a normal sequence of statements , but not as the then- clause in an if statement:

Code Block
bgColor#FFcccc
langc

int x, y, z, tmp;
if (z == 0)
  SWAP( x, y);

This will expand toIt expands to the following, which is certainly not what the programmer intended:

Code Block
bgColor#FFcccc
langc

int x, y, z, tmp;
if (z == 0)
  tmp = x;
x = y;
y = tmp;

This is certainly not what the programmer intendedFurthermore, this macro violates PRE02-C. Macro replacement lists should be parenthesized.

Noncompliant Code Example

This noncompliant code example parenthesizes its macro arguments, but inadequately bounds multiple statements.:

Code Block
bgColor#FFcccc
langc

/*
 * Swaps two values. and requires
 * Requires tmp variable to be defined.
 */
#define SWAP(x, y) { tmp = (x); (x) = (y); (y) = tmp; }

This macro fails to expand correctly in some case, such as the following example, which is meant to be an if- statement with two branches:

Code Block
bgColor#FFcccc
langc

if (x > y)
  SWAP(x, y);          /* Branch 1 */
else  
  do_something();     /* Branch 2 */

Following macro expansion, however, this code is interpreted as an if- statement with only one branch:

Code Block
bgColor#FFcccc
langc

if (x > y) { /* Single-branch if-statement!!! */

  tmp = x;   /* The one and only branch consists */
  x = y;     /* of the block. */
  y = tmp;
}
;            /* emptyEmpty statement */
else         /* ERROR!!! "parse error before else" */
  do_something();

The problem is the semi-colon ';' semicolon (;) following the block.

Compliant Solution

Wrapping the macro inside a do-while loop mitigates the problem.:

Code Block
bgColor#ccccFF
langc

/*
 * Swaps two values. and requires
 * Requires tmp variable to be defined.
 */
#define SWAP(x, y) \
  do { \
    tmp = (x); \
    (x) = (y); \
    (y) = tmp; } \
  while (0)

The The do-while loop will always be executed exactly once.

This macro still violates the recommendation PRE12-C. Do not define unsafe macros, because both macro arguments are evaluated twice. It is expected that the arguments are simple lvalues.

Risk Assessment

Improperly wrapped statement macros can result in unexpected and difficult to diagnose behavior.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

PRE10-C

medium

Medium

probable

Probable

low

Low

P12

L1

Automated Detection

ToolVersionCheckerDescription
Axivion Bauhaus Suite

Include Page
Axivion Bauhaus Suite_V
Axivion Bauhaus Suite_V

CertC-PRE10
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

C3412, C3458
Klocwork
Include Page
Klocwork_V
Klocwork_V
MISRA.DEFINE.BADEXP
LDRA tool suite
Include Page
LDRA_V
LDRA_V
79 SEnhanced enforcement
PC-lint Plus

Include Page
PC-lint Plus_V
PC-lint Plus_V

9502

Fully supported

Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

CERT C: Rec. PRE10-CChecks for macros with multiple statements (rule fully covered)

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: PRE10-CPP. Wrap multi-statement macros in a do-while loop

...

:2013Pre-processor

...

Directives [NMP]

Bibliography


...

Image Modified Image Modified Image Modified