Macro replacement lists should be parenthesized to protect any lower precedence operators from the surrounding expression. See also PRE00-A. Prefer inline functions to macros and PRE01-A. Use parentheses within macros around parameter names.
Non-Compliant Code Example
This CUBE()
macro definition is non-compliant because it fails to parenthesize the replacement list.
#define CUBE(X) (X) * (X) * (X) int i = 3; int a = 81 / CUBE(i);
As a result, the invocation
int a = 81 / CUBE(i);
expands to
int a = 81 / i * i * i;
which evaluates as
int a = ((81 / i) * i) * i); /* evaluates to 243 */
which is not the desired behavior. This example also violates PRE00-A. Prefer inline functions to macros.
Compliant Solution
With its replacement list parenthesized, the CUBE()
macro expands correctly for this type of invocation.
#define CUBE(X) ((X) * (X) * (X)) int i = 3; int a = 81 / CUBE(i);
Non-Compliant Code Example
In this non-compliant coding example, EOF
is defined as -1
. The macro replacement list consists of a unary negation operator '-' followed by an integer literal '1'.
#define EOF -1 /* ... */ if (getchar() EOF) { /* ... */ }
In this example, the programmer has mistakenly omitted the comparison operator (see MSC02-A. Avoid errors of omission) from the conditional statement, which should be getchar() != EOF
. After macro expansion, the conditional expression is incorrectly evaluated as a binary operation: getchar()-1
. This is syntactically correct, even though it is certainly not what the programmer intended.
Parenthesizing the -1
in the declaration of EOF
ensures that the macro expansion is evaluated correctly.
#define EOF (-1)
Once this modification is made, the non-compliant code example no longer compiles because the macro expansion results in the conditional expression getchar() (-1)
, which is no longer syntactically valid.
Compliant Solution
The following compliant solution uses parentheses around the macro replacement list and adds the (previously omitted) comparison operator.
#define EOF (-1) /* ... */ if (getchar() != EOF) { /* ... */ }
Note that there must be a space after EOF
because otherwise it becomes a function-like macro (and one that is incorrectly formed, since -1 cannot be a formal parameter).
Exceptions
PRE02-EX1. A macro that expands to a single identifier or function call is not affected by the precedence of any operators in the surrounding expression, so its replacement list need not be parenthesized.
#define MY_PID getpid()
Risk Assessment
Failing to parenthesize macro replacement lists can cause unexpected results.
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
PRE02-A |
1 (low) |
1 (unlikely) |
3 (low) |
P3 |
L3 |
Automated Detection
The LDRA tool suite V 7.6.0 is able to detect violations of this recommendation.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[ISO/IEC 9899-1999]] Section 6.10, "Preprocessing directives," and Section 5.1.1, "Translation environment"
[[Plum 85]] Rule 1-1
[[Summit 05]] Question 10.1
PRE01-A. Use parentheses within macros around parameter names 01. Preprocessor (PRE) PRE03-A. Prefer typedefs to defines for encoding types