MSC09-J. Finish every set of statements associated with a case label with a break statement

A switch block comprises several case labels and an optional but highly recommended default label. Statements that follow each case label must end with a break statement, which is responsible for transferring the control to the end of the switch block. When omitted, the statements in the subsequent case label are executed. Because the break statement is optional, omitting it produces no compiler warnings. When this behavior is unintentional, it can cause unexpected control flow.

Noncompliant Code Example

In this noncompliant code example, the case wherein the card is 11 lacks a break statement. As a result, execution continues with the statements for card = 12.

int card = 11;

switch (card) {
  /* ... */
  case 11: 
    System.out.println("Jack");
  case 12: 
    System.out.println("Queen"); 
    break;
  case 13: 
    System.out.println("King"); 
    break;
  default: 
    System.out.println("Invalid Card"); 
    break;
}

Compliant Solution

This compliant solution terminates each case (including the default case) with a break statement.

int card = 11;

switch (card) {
  /* ... */
  case 11: 
    System.out.println("Jack");
    break;
  case 12: 
    System.out.println("Queen"); 
    break;
  case 13: 
    System.out.println("King"); 
    break;
  default: 
    System.out.println("Invalid Card"); 
    break;
}

Exceptions

MSC09-EX1: The break statement at the end of the final case in a switch statement may be omitted. By convention, this is the default label. The break statement serves to transfer control to the end of the switch block. Fall-through behavior also causes control to arrive at the end of the switch block. Consequently, control transfers to the statements following the switch block without regard to the presence or absence of the break statement. Nevertheless, the final case in a switch statement should end with a break statement, in accordance with good programming style (see [[Rogue 2000]]).

MSC09-EX2: When multiple cases require execution of identical code, then break statements may be omitted from all cases except the last one. For example:

int card = 11;
int value;

// Cases 11,12,13 fall through to the same case 
switch (card) {
  // MSC13-J:EX2: these three cases are treated identically 
  case 11:        // break not required
  case 12:        // break not required
  case 13: 
    value = 10; 
    break;        // break required
  default: 
    // Handle Error Condition 
}

MSC09-EX3: When a case ends with a return or throw statement, the break statement may be omitted.

Risk Assessment

Failure to include break statements can cause unexpected control flow.

Other Languages

This rule appears in the C Secure Coding Standard as MSC17-C. Finish every set of statements associated with a case label with a break statement.

This rule appears in the C++ Secure Coding Standard as MSC18-CPP. Finish every set of statements associated with a case label with a break statement.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

MSC08-J. Do not modify the underlying collection when an iteration is in progress      49. Miscellaneous (MSC)      MSC10-J. Use inequality operators to terminate loops whose counter changes by more than one