...
The C Standard, 5.1.1.2, paragraph 4 [ISO/IEC 9899:20112024], says
If a character sequence that matches the syntax of a universal character name is produced by token concatenation (6.10.35.3), the behavior is undefined.
...
Creating a universal character name through token concatenation results in undefined behavior. See undefined behavior 3.
Rule | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
PRE30-C | Low | Unlikely | Yes | NoMedium | P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| macrouniversal-character- | argumentname- | hashconcatenation | Fully | checkedimplemented | ||||||||||||||
| CertC-PRE30 | Fully implemented | ||||||||||||||||||
| CodeSonar |
| LANG.PREPROC.PASTE LANG.PREPROC.PASTEHASH | Macro uses ## operator## follows # operator | |||||||||||||||||
| Cppcheck |
| preprocessorErrorDirective | ||||||||||||||||||
| Cppcheck Premium |
| preprocessorErrorDirective | ||||||||||||||||||
| Helix QAC |
| C0905 C++0064,C++0080 | Fully implemented | |||||||||||||||||
| Klocwork |
| MISRA.DEFINE.SHARP | Fully implemented | |||||||||||||||||
| LDRA tool suite |
| 573 S | Fully implemented | |||||||||||||||||
| Parasoft C/C++test |
| CERT_C-PRE30-a | Avoid token concatenation that may produce universal character names | |||||||||||||||||
| Universal CERT C: Rule PRE30-C | Checks for universal character name from token concatenation | You create a universal character name by joining tokens with ## operator | PRQA QA-C | ||||||||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | 0905 | PRQA QA-C++ | ||||||||||||||||
| Include Page | cplusplus:PRQA QA-C++_V | cplusplus:PRQA QA-C++_V | (rule fully covered) | |||||||||||||||||
| RuleChecker |
| universal-character-name-concatenation | Fully checked | |||||||||||||||||
| Security Reviewer - Static Reviewer |
| RTOS_27 | Fully implemented | 0064, 0080 | RuleChecker | |||||||||||||||
| Include Page | RuleChecker_V | RuleChecker_V | macro-argument-hash | Fully checked
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Bibliography
| [ISO/IEC 10646-2003] | |
| [ISO/IEC 9899:20112024] | Subclause 5.1.1.2, "Translation Phases" |
...