Page History

...

#if 0  /*
        * Use of critical security function no
        * longer necessary.
        */
security_critical_function();
/* Some other comment */
#endif

...

This compliant solution takes advantage of the compiler's ability to remove unreachable (dead) code. The code inside the if block must remain acceptable to the compiler. If other parts of the program, such as macros, types, or function prototypes, later change later in a way that would cause syntax errors, the unexecuted code must be brought up to date to correct the problem. Then, if it is needed again in the future, the programmer need only remove the surrounding if statement and the NOTREACHED comment.

The NOTREACHED comment tells some compilers and static analysis tools not to complain about this unreachable code. It also serves as documentation.

if (0) {  /*
           * Use of critical security function no
           * longer necessary, for now.
           */
  /*NOTREACHED*/
  security_critical_function();
  /* Some other comment */
}

...

// */          /* Comment, not syntax error */

f = g/**//h;   /* Equivalent to f = g / h; */

//\
i();           /* Part of a two-line comment */

/\
/ j();         /* Part of a two-line comment */


/*//*/ l();    /* Equivalent to l(); */

m = n//**/o
+ p;           /* Equivalent to m = n + p; */

a = b //*divisor:*/c
+d;            /*
                * Interpreted as a = b/c + d; in c90
                * compiler and a = b + d; in c99 compiler.
                */

Compliant Solution

Use a consistent style of commenting:

...

Confusion over which instructions are executed and which are not can lead to serious programming errors and vulnerabilities, including denial of service, abnormal program termination, and data integrity violation. This problem is mitigated by the use of interactive development environments (IDEs) and editors that use fonts, colors, or other mechanisms to differentiate between comments and code. However, the problem can still manifest, for example, when reviewing source code printed on a black-and-white printer.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...