Page History

Do not include any executable statements inside a switch statement before the first case label. According to the C Standard, subclause 6.8.4.2, paragraph 4 [ISO/IEC 9899:2011],

A switch statement causes control to jump to, into, or past the statement that is the switch body, depending on the value of a controlling expression, and on the presence of a default label and the values of any case labels on or in the switch body.

...

When the preceding example is executed on GCC version 4.8.1, the variable i is instantiated with automatic storage duration within the block, but it is not initialized. Consequently, if the controlling expression has a nonzero value, the call to printf() will access an indeterminate value of i. Similarly, the call to f() is not executed.

...

#include <stdio.h>
 
extern void f(int i);
 
int func(int expr) {

  /*
   * Move the code outside the switch block, now the statements
   *  will get executed.
   */
  int i = 4;
  f(i);

  switch(expr) {
    case 0:
      i = 17;
      /* Falls through into default code */
    default:
      printf("€œ%d\n"€, i);
  }
  return 0;
}

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Bibliography

...