MSC13-A. Detect and remove unused values

The presence of unused values may indicate significant logic errors. To prevent such errors unused values should be identified and removed from code.

Non-Compliant Code Example

In this example, p2 is assigned the value returned by bar(), but that value is never used. Note this example assumes that foo() and bar() return valid pointers [[DCL30-C]].

int *p1, *p2;
p1 = foo();
p2 = bar();

if(baz())
   return p1;
else
    p2 = p1;
return p2;

Compliant Solution

This example can be corrected many different ways depending on the intent of the programmer. In this compliant solution, p2 is initialized to NULL rather than the result of bar(). If bar() does not produce any side effects, then it can be removed.

int *p1, *p2;
p1 = foo();
p2 = NULL;
bar(); /* Removable if bar() does not have any side effects */
if(baz())
   return p1;
else
    p2 = p1;
return p2;

Risk Assessment

The presence of unused values may indicate significant logic errors.

Automated Detection

The Coverity Prevent UNUSED_VALUE checker finds variables that are assigned pointer values returned from a function call but never used.. Coverity Prevent cannot discover all violations of this rule so further verification is necessary.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERTwebsite.

References

Coverity 07 Coverity Prevent? User's Manual (3.3.0) (2007).