According to the C Standard, 7.1.3 [ISO/IEC 9899:2011],
All identifiers that begin with an underscore and either an uppercase letter or another underscore are always reserved for any use.
All identifiers that begin with an underscore are always reserved for use as identifiers with file scope in both the ordinary and tag name spaces.
Each macro name in any of the following subclauses (including the future library directions) is reserved for use as specified if any of its associated headers is included, unless explicitly stated otherwise.
All identifiers with external linkage (including future library directions) and
errnoare always reserved for use as identifiers with external linkage.
Each identifier with file scope listed in any of the following subclauses (including the future library directions) is reserved for use as a macro name and as an identifier with file scope in the same name space if any of its associated headers is included.
Additionally, subclause 7.31 defines many other reserved identifiers for future library directions.
Noncompliant Code Example (Include Guard)
A common, but noncompliant, practice is to choose a reserved name for a macro used in a preprocessor conditional guarding against multiple inclusions of a header file. (See also PRE06-C. Enclose header files in an include guard.) The name may clash with reserved names defined by the implementation of the C standard library in its headers or with reserved names implicitly predefined by the compiler even when no C standard library header is included.
Compliant Solution (Include Guard)
This compliant solution avoids using leading underscores in the macro name of the include guard:
Noncompliant Code Example (File Scope Objects)
In this noncompliant code example, the names of the file scope objects
_limit both begin with an underscore. Because
_max_limit is static, this declaration might seem to be impervious to clashes with names defined by the implementation. However, because the header
<stddef.h> is included to define
size_t, a potential for a name clash exists. (Note, however, that a conforming compiler may implicitly declare reserved names regardless of whether any C standard library header is explicitly included.)
In addition, because
_limit has external linkage, it may clash with a symbol of the same name defined in the language runtime library even if such a symbol is not declared in any header. Consequently, it is not safe to start the name of any file scope identifier with an underscore even if its linkage limits its visibility to a single translation unit.
Compliant Solution (File Scope Objects)
In this compliant solution, names of file scope objects do not begin with an underscore:
Noncompliant Code Example (Reserved Macros)
In this noncompliant code example, because the C standard library header
<inttypes.h> is specified to include
<stdint.h>, the name
SIZE_MAX conflicts with a standard macro of the same name, which is used to denote the upper limit of
size_t. In addition, although the name
INTFAST16_LIMIT_MAX is not defined by the C standard library, it is a reserved identifier because it begins with the
INT prefix and ends with the
_MAX suffix. (See the C Standard, 7.31.10.)
Compliant Solution (Reserved Macros)
This compliant solution avoids redefining reserved names or using reserved prefixes and suffixes:
Noncompliant Code Example (Identifiers with External Linkage)
This noncompliant example provides definitions for the C standard library functions
free(). Although this practice is permitted by many traditional implementations of UNIX (for example, the Dmalloc library), it is undefined behavior according to the C Standard. Even on systems that allow replacing
malloc(), doing so without also replacing
realloc() is likely to cause problems.
Compliant Solution (Identifiers with External Linkage)
The compliant, portable solution avoids redefining any C standard library identifiers with external linkage. In addition, it provides definitions for all memory allocation functions:
Noncompliant Code Example (
In addition to symbols defined as functions in each C standard library header, identifiers with external linkage include
math_errhandling. According to the C Standard, 7.5, paragraph 2 [ISO/IEC 9899:2011], the behavior of a program is undefined when
A macro definition of
errnois suppressed in order to access an actual object, or the program defines an identifier with the name
errno identifier expands to a modifiable lvalue that has type
int but is not necessarily the identifier of an object. It might expand to a modifiable lvalue resulting from a function call, such as
*errno(). It is unspecified whether
errno is a macro or an identifier declared with external linkage. If a macro definition is suppressed to access an actual object, or if a program defines an identifier with the name
errno, the behavior is undefined.
Legacy code is apt to include an incorrect declaration, such as the following:
Compliant Solution (
The correct way to declare
errno is to include the header
DCL37-C-EX1: Provided that a library function can be declared without reference to any type defined in a header, it is permissible to declare that function without including its header provided that declaration is compatible with the standard declaration.
Such code is compliant because the declaration matches what
stdlib.h would provide and does not redefine the reserved identifier. However, it would not be acceptable to provide a definition for the
free() function in this example.
DCL37-C-EX2: For compatibility with other compiler vendors or language standard modes, it is acceptable to create a macro identifier that is the same as a reserved identifier so long as the behavior is idempotent, as in this example:
DCL37-C-EX3: As a compiler vendor or standard library developer, it is acceptable to use identifiers reserved for your implementation. Reserved identifiers may be defined by the compiler, in standard library headers or headers included by a standard library header, as in this example declaration from the glibc standard C library implementation:
Using reserved identifiers can lead to incorrect program operation.
|Axivion Bauhaus Suite|
|CertC-DCL37||Fully implemented. Reserved identifiers, as in DCL37-C-EX3, are configurable.|
|Declaration of reserved name|
MISRA C 2004 Rule 20.1
MISRA C 2004 Rule 20.2
MISRA C 2012 Rule 21.1
MISRA C 2012 Rule 21.2
C0602, C0603, C4600, C4601, C4602, C4603, C4604, C4605, C4606, C4607, C4608, C4620, C4621, C4622, C4623, C4624, C4640, C4641, C4642, C4643, C4644, C4645
|LDRA tool suite|
86 S, 218 S, 219 S, 580 S, 626 S
|Do not #define or #undef identifiers with names which start with underscore|
978, 9071, 9093
|Polyspace Bug Finder|
Rule partially covered
0602, 0603, 4600, 4601, 4602,
4603, 4604, 4605, 4606, 4607,
4608, 4620, 4621, 4622, 4623,
4624, 4640, 4641, 4642, 4643,
|SonarQube C/C++ Plugin|
Key here (explains table format and definitions)
|CERT C Secure Coding Standard||PRE00-C. Prefer inline or static functions to function-like macros||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C Secure Coding Standard||PRE06-C. Enclose header files in an include guard||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C Secure Coding Standard||PRE31-C. Avoid side effects in arguments to unsafe macros||Prior to 2018-01-12: CERT: Unspecified Relationship|
|CERT C||DCL51-CPP. Do not declare or define a reserved identifier||Prior to 2018-01-12: CERT: Unspecified Relationship|
|ISO/IEC TS 17961||Using identifiers that are reserved for the implementation [resident]||Prior to 2018-01-12: CERT: Unspecified Relationship|
|MISRA C:2012||Rule 21.1 (required)||Prior to 2018-01-12: CERT: Unspecified Relationship|
|MISRA C:2012||Rule 21.2 (required)||Prior to 2018-01-12: CERT: Unspecified Relationship|
|[IEEE Std 1003.1-2013]||Section 2.2, "The Compilation Environment"|
|[ISO/IEC 9899:2011]||7.1.3, "Reserved Identifiers"|
7.31.10, "Integer Types