UB | Class | Description | Guideline |
|---|
UB | Description | Guidelines |
|---|
| 
| A "shall" or "shall not" requirement that appears outside of a constraint is violated (clause 4). | MSC15-C |
| 
| A nonempty source file does not end in a new-line character which is not immediately preceded by a backslash character or ends in a partial preprocessing token or comment (5.1.1.2). |
|
|
|
| Token concatenation produces a character sequence matching the syntax of a universal character name (5.1.1.2). | PRE30-C |
|
| A program in a hosted environment does not define a function named main using one of the specified forms (5.1.2.3.2 |
.1 | 6
|
|
| The execution of a program contains a data race (5.1.2.5). |
|
|
| A character not in the basic source character set is encountered in a source file, except in an identifier, a character constant, a string literal, a header name, a comment, or a preprocessing token that is never converted to a token (5.2.1). |
| 66 |
| An identifier, comment, string literal, character constant, or header name contains an invalid multibyte character or does not begin and end in the initial shift state (5.2. |
1. 7 | 77 |
| The same identifier has both internal and external linkage in the same translation unit (6.2.2). | DCL36-C |
8 88 9 99 |
| The value of a pointer to an object whose lifetime has ended is used (6.2.4). | DCL30-C, EXP33-C |
10 1010 |
| The value of an object with automatic storage duration is used while |
it is indeterminate the object has an indeterminate representation (6.2.4, 6.7. |
8 11 1111 |
| A |
trap non-value representation is read by an lvalue expression that does not have character type (6.2.6.1). | EXP33-C |
12 1212 |
| A |
trap non-value representation is produced by a side effect that modifies any part of the |
object using 13 object using an lvalue expression that does not have character type (6.2.6.1). |
| 1313 The arguments to certain operators are such that could produce a negative zero result, but the implementation does not support negative zeros |
| Two declarations of the same object or function specify types that are not compatible (6.2. |
6.2 14 | 1414 Two declarations of the same object or function specify types that are not compatible 15 |
| A program requires the formation of a composite type from a variable length array type whose size is specified by an expression that is not evaluated (6.2.7). |
DCL32-C | 1515 |
| Conversion to or from an integer type produces a value outside the range that can be represented (6.3.1.4). | FLP34-C |
16 1616 |
| Demotion of one real floating type to another produces a value outside the range that can be represented (6.3.1.5). | FLP34-C |
17 1717 18 |
| An lvalue does not designate an object when evaluated (6.3.2.1). |
| 1818 19 |
| A non-array lvalue with an incomplete type is used in a context that requires the value of the designated object (6.3.2.1). |
| |
|
|
| An lvalue designation an object of automatic storage duration that could have been declared with the register storage class is used in a context that requires the value of the designated object, but the object is uninitialized (6.3.2.1). |
|
21 |
1919 |
| An lvalue having array type is converted to a pointer to the initial element of the array, and the array object has register storage class (6.3.2.1). |
20 2020 21 |
| An attempt is made to use the value of a void expression, or an implicit or explicit conversion (except to void) is applied to a void expression (6.3.2.2). |
| 2121 |
| Conversion of a pointer to an integer type produces a value outside the range that can be represented (6.3.2.3). |
INT11 22 2222 |
| Conversion between two pointer types produces a result that is incorrectly aligned (6.3.2.3). | EXP36-C |
23 2323 |
| A pointer is used to call a function whose type is not compatible with the |
pointed-to type referenced type (6.3.2.3). |
24 2424 |
| An unmatched ' or " character is encountered on a logical source line during tokenization (6.4). |
25 2525 |
| A reserved keyword token is used in translation phase 7 or 8 |
for 26 (5.1.1.2) for some purpose other than as a keyword (6.4.1). |
| 2626 27 |
| A universal character name in an identifier does not designate a character whose encoding falls into one of the specified ranges (6.4.2.1). |
| 2727 |
| The initial character of an identifier is a universal character name designating a digit (6.4.2.1). |
28 2828 |
| Two identifiers differ only in nonsignificant characters (6.4.2.1). |
DCL32 29 2929 |
| The identifier __func__ |
is is explicitly declared (6.4.2.2). |
30 3030 | 
| The program attempts to modify a string literal (6.4.5). | STR30-C |
31 3131 |
| The characters ', back-slash, ", /, or /* occur in the sequence between the < and > delimiters, or the characters ', back-slash, //, or /* occur in the sequence between the " delimiters, in a header name preprocessing token (6.4.7). |
32 3232 Between two sequence points, an object is modified more than once, or is modified and the prior value is read other than to determine the value to be stored |
| A side effect on a scalar object is unsequenced relative to either a different side effect on the same scalar object or a value computation using the value of the same scalar object (6.5.1). |
33 3333 |
| An exceptional condition occurs during the evaluation of an expression (6.5.1). |
34 3434 |
| An object has its stored value accessed other than by an lvalue of an allowable type (6.5.1). |
EXP39 35 3535 An attempt is made to modify the result of a function call, a conditional operator, an assignment operator, or a comma operator, or to access it after the next sequence point 36 |
| A function is defined with a type that is not compatible with the type (of the expression) pointed to by the expression that denotes the called function (6.5. |
2.2, 6.5.15, 6.5.16, 6.5.17). EXP35-C | 3636 For a call to a function without a function prototype in scope, the number of arguments does not equal the number of parameters |
| A member of an atomic structure or union is accessed (6.5. |
22 37 3737 For call to a function without a function prototype in scope where the function is defined with a function prototype, either the prototype ends with an ellipsis or the types of the arguments after promotion are not compatible with the types of the parameters |
| The operand of the unary * operator has an invalid value (6.5. |
2 38 3838 For a call to a function without a function prototype in scope where the function is not defined with a function prototype, the types of the arguments after promotion are not compatible with those of the parameters after promotion (with certain exceptions) (6.5.2.2). | | 39 |
| A pointer is converted to other than an integer or pointer type (6.5.5). |
|
|
| The value of the second operand of the / or % operator is zero (6.5.6). | INT33-C |
|
3939 A function is defined with a type that is not compatible with the type (of the expression) pointed to by the expression that denotes the called function |
| If the quotient a/b is not representable, the behavior of both a/b and a%b (6.5. |
2.2 40 | 4040 The operand of the unary * operator has an invalid value |
| Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object (6.5. |
3.2 41 4141 A pointer is converted to other than an integer or pointer type |
| Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that points just beyond the array object and is used as the operand of a unary * operator that is evaluated (6.5. |
4 42 4242 The value of the second operand of the / or % operator is zero |
| Pointers that do not point into, or just beyond, the same array object are subtracted (6.5. |
5INT33 43 4343 Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object |
| An array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression a[1][7] given the declaration int a[4][5]) (6.5. |
6 44 , ARR35-C , ARR38-C 4444 Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that points just beyond the array object and is used as the operand of a unary * operator that is evaluated |
| The result of subtracting two pointers is not representable in an object of type ptrdiff_t (6.5. |
6 45 ARR30-C , ARR35-C | 4545 Pointers that do not point into, or just beyond, the same array object are subtracted |
| An expression is shifted by a negative number or by an amount greater than or equal to the width of the promoted expression (6.5. |
6ARR36 46 <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b7e8f21d-6cfa-43b9-affe-9839d2a02787"><ac:plain-text-body><![CDATA[ | |
|
| An expression having signed promoted type is left-shifted and either the value of the expression is negative or the result of shifting would not be representable in the promoted type (6.5.8). |
|
|
4646 An array subscript is out of range, even if an object is apparently accessible with the given subscript (as in the lvalue expression a[1][7] given the declaration int a[4][5]) |
| Pointers that do not point to the same aggregate or union (nor just beyond the same array object) are compared using relational operators (6.5. |
6 47 | ]]></ac:plain-text-body></ac:structured-macro> | 4747 The result of subtracting two pointers is not representable in an object of type ptrdiff_t |
| An object is assigned to an inexactly overlapping object or to an exactly overlapping object with incompatible type (6.5. |
6 48 | 4848 INT34-C | 49 |
| An expression |
is shifted by a negative number or by an amount greater than or equal to the width of the promoted expression (6.5.7). that is required to be an integer constant expression does not have an integer type; has operands that are not integer constants, named constants, compound literal constants, enumeration constants, character constants, predefined constants, sizeof expressions whose results are integer constants, alignof expressions, or immediately-cast floating constants; or contains casts (outside operands to sizeof and alignof operators) other than conversions of arithmetic types to integer types (6.6). |
|
|
4949 An expression having signed promoted type is left-shifted and either the value of the expression is negative or the result of shifting would be not be representable in the promoted type (6.5.7). | | 50 | Anchor |
|---|
ub_50 | ub_50 | Pointers that do not point to the same aggregate or union (nor just beyond the same array object) are compared using relational operators (6.5.8). | ARR36-C | 51 | Anchor |
|---|
ub_51 | ub_51 | An object is assigned to an inexactly overlapping object or to an exactly overlapping object with incompatible type (6.5.16.1). | | 52 | Anchor |
|---|
ub_52 | ub_52 | An expression that is required to be an integer constant expression does not have an integer type; has operands that are not integer constants, enumeration constants, character constants, sizeof expressions whose results are integer constants, or immediately-cast floating constants; or contains casts (outside operands to sizeof operators) other than conversions of arithmetic types to integer types (6.6). | | 53 | Anchor |
|---|
ub_53 | ub_53 | A constant expression in an initializer is not, or does not evaluate to, one of the following: an arithmetic constant expression, a null pointer constant, an address constant, or an address constant for an object type plus or minus an integer constant expression (6.6). | | 54 | Anchor |
|---|
ub_54 | ub_54 | An arithmetic constant expression does not have arithmetic type; has operands that are not integer constants, floating constants, enumeration constants, character constants, or sizeof expressions; or contains casts (outside operands to sizeof operators) other than conversions of arithmetic types to arithmetic types (6.6). | | <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c080426c-193c-4269-bd06-aca074ddb462"><ac:plain-text-body><![CDATA[ | 55 | Anchor |
|---|
ub_55 | ub_55 | The value of an object is accessed by an array-subscript [], member-access . or ?>, address &, or indirection * operator or a pointer cast in creating an address constant (6.6). | | ]]></ac:plain-text-body></ac:structured-macro> | |
| A constant expression in an initializer is not, or does not evaluate to, one of the following: a named constant, a compound literal constant, an arithmetic constant expression, a null pointer constant, an address constant, or an address constant for a complete object type plus or minus an integer constant expression (6.6). |
|
|
| An arithmetic constant expression does not have arithmetic type; has operands that are not integer constants, floating constants, named and compound literal constants of arithmetic type, character constants, predefined constants, sizeof expressions whose results are integer constants, or alignof expressions; or contains casts (outside operands to sizeof or alignof operators) other than conversions of arithmetic types to arithmetic types (6.6). |
|
|
| The value of an object is accessed by an array-subscript [], member-access . or ->, address &, or indirection * operator or a pointer cast in creating an address constant (6.6). |
|
|
| An identifier for an object is declared with no linkage and the type of the object is incomplete after its declarator, or after its init-declarator if it has an initializer (6.7). |
|
|
| A function is declared at block scope with an explicit storage-class specifier other than extern (6.7.2). |
|
|
| A structure or union is defined as containing no named members (including those specified indirectly via anonymous structures and unions) (6.7.3.2). |
|
|
| An attempt is made to access, or generate a pointer to just past, a flexible array member of a structure when the referenced object provides no elements for that array (6.7.3.2). | ARR30-C |
|
| When the complete type is needed, an incomplete structure or union type is not completed in the same scope by another declaration of the tag that defines the content (6.7.3.4). |
|
|
| An attempt is made to modify an object defined with a const-qualified type through use of an lvalue with non-const-qualified type (6.7.4). | EXP05-C, EXP40-C |
|
| An attempt is made to refer to an object defined with a volatile-qualified type through use of an lvalue with non-volatile-qualified type (6.7.4). | EXP32-C |
|
| The specification of a function type includes any type qualifiers (6.7.4). |
|
|
| Two qualified types that are required to be compatible do not have the identically qualified version of a compatible type (6.7.4). |
|
|
| An object which has been modified is accessed through a restrict-qualified pointer to a const-qualified type, or through a restrict-qualified pointer and another pointer that are not both based on the same object (6.7.4.2). | EXP43-C |
|
| A restrict-qualified pointer is assigned a value based on another restricted pointer whose associated block neither began execution before the block associated with this pointer, nor ended before the assignment (6.7.4.2). |
|
|
| A function with external linkage is declared with an inline function specifier, but is not also defined in the same translation unit (6.7.5). |
|
|
| A function declared with a _Noreturn function specifier returns to its caller (6.7.5). |
|
|
| The definition of an object has an alignment specifier and another declaration of that object has a different alignment specifier (6.7.6). |
|
|
| Declarations of an object in different translation units have different alignment specifiers (6.7.6). |
|
|
| Two pointer types that are required to be compatible are not identically qualified, or are not pointers to compatible types (6.7.7.2). |
|
|
| The size expression in an array declaration is not a constant expression and evaluates at program execution time to a nonpositive value (6.7.7.3). | ARR32-C |
|
| In a context requiring two array types to be compatible, they do not have compatible element types, or their size specifiers evaluate to unequal values (6.7.7.23). | EXP39-C |
|
| A declaration of an array parameter includes the keyword static within the [ and ] and the corresponding argument does not provide access to the first element of an array with at least the specified number of elements (6.7.7.4). |
|
|
| A storage-class specifier or type qualifier modifies the keyword void as a function parameter type list (6.7.7.4). |
|
|
| In a context requiring two function |
56 | Anchor |
|---|
ub_56 | ub_56 | An identifier for an object is declared with no linkage and the type of the object is incomplete after its declarator, or after its init-declarator if it has an initializer (6.7). | | 57 | Anchor |
|---|
ub_57 | ub_57 | A function is declared at block scope with an explicit storage-class specifier other than extern (6.7.1). | | 58 | Anchor |
|---|
ub_58 | ub_58 | A structure or union is defined as containing no named members (6.7.2.1). | | 59 | Anchor |
|---|
ub_59 | ub_59 | An attempt is made to access, or generate a pointer to just past, a flexible array member of a structure when the referenced object provides no elements for that array (6.7.2.1). | | 60 | Anchor |
|---|
ub_60 | ub_60 | When the complete type is needed, an incomplete structure or union type is not completed in the same scope by another declaration of the tag that defines the content (6.7.2.3). | | 61 | Anchor |
|---|
ub_61 | ub_61 | An attempt is made to modify an object defined with a const-qualified type through use of an lvalue with non-const-qualified type (6.7.3). | EXP05-C , EXP40-C | 62 | Anchor |
|---|
ub_62 | ub_62 | An attempt is made to refer to an object defined with a volatile-qualified type through use of an lvalue with non-volatile-qualified type (6.7.3). | EXP32-C | 63 | Anchor |
|---|
ub_63 | ub_63 | The specification of a function type includes any type qualifiers (6.7.3). | | 64 | Anchor |
|---|
ub_64 | ub_64 | Two qualified types that are required to be compatible do not have the identically qualified version of a compatible type (6.7.3). | | 65 | Anchor |
|---|
ub_65 | ub_65 | An object which has been modified is accessed through a restrict-qualified pointer to a const-qualified type, or through a restrict-qualified pointer and another pointer that are not both based on the same object (6.7.3.1). | DCL33-C | 66 | Anchor |
|---|
ub_66 | ub_66 | A restrict-qualified pointer is assigned a value based on another restricted pointer whose associated block neither began execution before the block associated with this pointer, nor ended before the assignment (6.7.3.1). | | 67 | Anchor |
|---|
ub_67 | ub_67 | A function with external linkage is declared with an inline function specifier, but is not also defined in the same translation unit (6.7.4). | | 68 | Anchor |
|---|
ub_68 | ub_68 | Two pointer types that are required to be compatible are not identically qualified, or are not pointers to compatible types (6.7.5.1). | | 69 | Anchor |
|---|
ub_69 | ub_69 | The size expression in an array declaration is not a constant expression and evaluates at program execution time to a nonpositive value (6.7.5.2). | | 70 | Anchor |
|---|
ub_70 | ub_70 | In a context requiring two array types to be compatible, they do not have compatible |
element size specifiers evaluate to unequal values parameters disagree in use of the ellipsis terminator or the number and type of parameters (after default argument promotion, when there is no parameter type list) (6.7. |
52 71 ARR34-C | <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="254d29df-d351-4abb-9b3a-6cd965b43439"><ac:plain-text-body><![CDATA[ | |
|
|
| A declaration for which a type is inferred contains a pointer, array, or function declarators (6.7.10). |
|
|
7171 A declaration of an array parameter includes the keyword static within the [ and ] and the corresponding argument does not provide access to the first element of an array with at least the specified number of elements |
| A declaration for which a type is inferred contains no or more than one declarators (6.7. |
5.3 72 | ]]></ac:plain-text-body></ac:structured-macro> |
|
|
| The value of an unnamed member of a structure or union is used (6.7.11). |
|
|
7272 A storage-class specifier or type qualifier modifies the keyword void as a function parameter type list |
| The initializer for a scalar is neither a single expression nor a single expression enclosed in braces (6.7. |
5.3 73 | 7373 In a context requiring two function types to be compatible, they do not have compatible return types, or their parameters disagree in use of the ellipsis terminator or the number and type of parameters (after default argument promotion, when there is no parameter type list or when one type is specified by a function definition with an identifier list) |
| The initializer for a structure or union object is neither an initializer list nor a single expression that has compatible structure or union type (6.7. |
5.3 74 | 7474 The value of an unnamed member of a structure or union is used (6.7.8). | | 75 7575 The initializer for a scalar is neither a single expression nor a single expression enclosed in braces (6.7.8). | | 76 | Anchor |
|---|
ub_76 | ub_76 | The initializer for a structure or union object that has automatic storage duration is neither an initializer list nor a single expression that has compatible structure or union type (6.7 77 |
| A function definition that does not have the asserted property is called by a function declaration or a function pointer with a type that has the unsequenced or reproducible attribute (6.7.13.8). |
| 7777 The initializer for an aggregate or union, other than an array initialized by a string literal, is not a brace-enclosed list of initializers for its elements or members (6.7.8). | | 78 | Anchor |
|---|
ub_78 | ub_78 | An |
| An identifier with external linkage is used, but in the program there does not exist exactly one external definition for the identifier, or the identifier is not used and there exist multiple external definitions for the identifier (6.9). |
79 7979 |
| A function |
definition includes an identifier list, but the types of the parameters are not declared in a following declaration list that accepts a variable number of arguments is defined without a parameter type list that ends with the ellipsis notation (6.9. |
1 80 80 82 | Anchor |
|---|
ub_82 | ub_82 | 80 An adjusted parameter type in a function definition is not an object type (6.9.1). | | 81 | Anchor |
|---|
ub_81 | ub_81 | A function that accepts a variable number of arguments is defined without a parameter type list that ends with the ellipsis notation (6.9.1). | | The } that terminates a function is reached, and the value of the function call is used by the caller (6.9. |
1 83 8383 |
| An identifier for an object with internal linkage and an incomplete type is declared with a tentative definition (6.9. |
2 84 | 84 |
| A non-directive preprocessing directive is executed (6.10). |
|
|
84 |
| The token defined is generated during the expansion of a #if or #elif preprocessing directive, or the use of the defined unary operator does not match one of the two specified forms prior to macro replacement (6.10. |
1 85 | 8585 |
| The #include preprocessing directive that results after expansion does not match one of the two header name forms (6.10. |
2 86 8686 |
| The character sequence in an #include preprocessing directive does not start with a letter (6.10. |
2 87 | 8787 |
| There are sequences of preprocessing tokens within the list of macro arguments that would otherwise act as preprocessing directives (6.10. |
3 88 8888 |
| The result of the preprocessing operator # is not a valid character string literal (6.10. |
3 89 8989 |
| The result of the preprocessing operator ## is not a valid preprocessing token (6.10. |
3 90 9090 |
| The #line preprocessing directive that results after expansion does not match one of the two well-defined forms, or its digit sequence specifies zero or a number greater than 2147483647 (6.10. |
4 91 | 9191 |
| A non-STDC #pragma preprocessing directive that is documented as causing translation failure or some other form of undefined behavior is encountered (6.10. |
6 92 9292 |
| A #pragma STDC preprocessing directive does not match one of the well-defined forms (6.10. |
6 93 9393 |
| The name of a predefined macro, or the identifier defined, is the subject of a #define or #undef preprocessing directive (6.10. |
8 94 | 9494 95 |
| An attempt is made to copy an object to an overlapping object by use of a library function, other than as explicitly allowed (e.g., memmove) (clause 7). |
| 9595 96 |
| A file with the same name as one of the standard headers, not provided as part of the implementation, is placed in any of the standard places that are searched for included source files (7.1.2). |
| 9696 97 |
| A header is included within an external declaration or definition (7.1.2). |
| 9797 |
| A function, object, type, or macro that is specified as being declared or defined by some standard header is used before any header that declares or defines it is included (7.1.2). |
98 9898 99 |
| A standard header is included while a macro is defined with the same name as a keyword (7.1.2). |
| 9999 |
| The program attempts to declare a library function itself, rather than via a standard header, but the declaration does not have external linkage (7.1.2). |
100 100100 |
| The program declares or defines a reserved identifier, other than as allowed by 7.1.4 (7.1.3). | DCL37-C |
101 101101 |
| The program removes the definition of a macro whose name begins with an underscore and either an uppercase letter or another underscore (7.1.3). |
102 102102 |
| An argument to a library function has an invalid value or a type not expected by a function with a variable number of arguments (7.1.4). |
103 103103 104 |
| The pointer passed to a library function array parameter does not have a value such that all address computations and object accesses are valid (7.1.4). |
| 104104 |
| The macro definition of assert is suppressed in order to access an actual function (7.2). |
105 105105 106 |
| The argument to the assert macro does not have a scalar type (7.2). |
| 106106 107 |
| The CX_LIMITED_RANGE, FENV_ACCESS, or FP_CONTRACT pragma is used in any context other than outside all external declarations or preceding all explicit declarations and statements inside a compound statement (7.3.4, 7.6.1, 7.12.2). |
| 107107 |
| The value of an argument to a character handling function is neither equal to the value of EOF nor representable as an unsigned char (7.4). | STR37-C |
108 108108 109 |
| A macro definition of errno is suppressed in order to access an actual object, or the program defines an identifier with the name errno (7.5). |
| 109109 |
| Part of the program tests floating-point status flags, sets floating-point control modes, or runs under non-default mode settings, but was translated with the state for the FENV_ACCESS pragma |
ââoffââ 110 | 110110 |
| The exception-mask argument for one of the functions that provide access to the floating-point status flags has a nonzero value not obtained by bitwise OR of the floating-point exception macros (7.6.2). |
111 111111 |
| The fesetexceptflag function is used to set floating-point status flags that were not specified in the call to the fegetexceptflag function that provided the value of the corresponding fexcept_t object (7.6. |
24 112 112112 |
| The argument to fesetenv or feupdateenv is neither an object set by a call to fegetenv or feholdexcept, nor is it an environment macro (7.6. |
44 113 | 113113 |
| The value of the result of an integer arithmetic or conversion function cannot be represented (7.8.2.1, 7.8.2.2, 7.8.2.3, 7.8.2.4, 7. |
202020 114 114114 |
| The program modifies the string pointed to by the value returned by the setlocale function (7.11.1.1). |
115 115115 The program modifies the structure pointed to by the value returned by the localeconv function |
| A pointer returned by the setlocale function is used after a subsequent call to the function, or after the calling thread has exited (7.11.1.1). |
|
|
| The program modifies the structure pointed to by the value returned by the localeconv function (7.11.2.1). |
116 116116 |
| The initializer for an aggregate or union, other than an array initialized by a string literal, is not a brace-enclosed list of initializers for its elements or members (6.7.11).A macro definition of math_errhandling is suppressed or the program defines an identifier with the name math_errhandling (7.12). |
117 117117 |
| An argument to a floating-point classification or comparison macro is not of real floating type (7.12.3, 7.12. |
14 118 | 118118 |
| A macro definition of setjmp is suppressed |
in order to access an actual function, or the program defines an external identifier with the name setjmp (7.13). |
119 119119 |
| An |
inv ocation invocation of the setjmp macro occurs other than in an allowed context (7.13.2.1). |
120 120120 |
| The longjmp function is invoked to restore a nonexistent environment (7.13.2.1). |
121 121121 |
| After a longjmp, there is an attempt to access the value of an object of automatic storage class with non-volatile-qualified type, local to the function containing the invocation of the corresponding setjmp macro, that was changed between the setjmp invocation and longjmp call (7.13.2.1). |
122 122122 |
| The program specifies an invalid pointer to a signal handler function (7.14.1.1). |
123 123123 |
| A signal handler returns when the signal corresponded to a computational exception (7.14.1.1). | SIG31-C |
124 124124 occurs as the result of calling the abort or raise function, and the signal handler calls handler called in response to SIGFPE, SIGILL, SIGSEGV, or any other implementation-defined value corresponding to a computational exception returns (7.14.1.1). | SIG35-C |
|
| A signal occurs as the result of calling the abort or raise function, and the signal handler calls the raise function (7.14.1.1). |
SIG33 125 125125 |
| A signal occurs other than as the result of calling the abort or raise function, and the |
signal handler signal handler refers to an object with static or thread storage duration that is not a lock-free atomic object other than by assigning a value to an object declared as volatile sig_atomic_t, or calls any function in the standard library other than the abort function, the_Exit function, |
or signal function (for the same signal number) ( quick_exit function, the functions in <stdatomic.h> (except where explicitly stated otherwise) when the atomic arguments are lock-free, the atomic_is_lock_free function with any atomic argument, or the signal function (for the same signal number) (7.14.1.1). | SIG31-C |
126 126126 |
| The value of errno is referred to after a signal occurred other than as the result of calling the abort or raise function and the corresponding signal handler obtained a SIG_ERR return from a call to the signal function (7.14.1.1). |
127 127127 128 |
| A signal is generated by an asynchronous signal handler (7.14.1.1). |
| |
|
|
| The signal function is used in a multi-threaded program (7.14.1.1). | CON37-C |
|
128128 |
| A function with a variable number of arguments attempts to access its varying arguments other than through a properly declared and initialized va_list object, or before the va_start macro is invoked (7. |
151515 129 | 129129 |
| The macro va_arg is invoked using the parameter ap that was passed to a function that invoked the macro va_arg with the same parameter (7. |
15 130 130130 |
| A macro definition of va_start, va_arg, va_copy, or va_end is suppressed in order to access an actual function, or the program defines an external identifier with the name va_copy or va_end (7. |
15 131 131131 |
| The va_start or va_copy macro is invoked without a corresponding invocation of the va_end macro in the same function, or vice versa (7. |
15151515 132 | 132132 type parameter to the not such that a pointer to an object of that type can be obtained simply by postfixing a * (7.15invoked when there is no actual next argument, or with a specified type that is not compatible with the promoted type of the actual next argument, with certain exceptions (7.16.1.1). |
133 133133 |
| The type parameter to the va_arg macro is |
invoked when there is no actual next argument, or with a specified type that is not compatible with the promoted type of the actual next argument, with certain exceptions (7.15not such that a pointer to an object of that type can be obtained simply by postfixing a * (7.16.1.1). |
DCL10-C 134 134134 The va_copy or va_start macro is called to initialize a va_list that was previously initialized |
| Using a null pointer constant in form of an integer expression as an argument to a . . . function and then interpreting it as a void* or char* (7.16.1.1). |
|
|
| The va_copy or va_start macro is called to initialize a va_list that was previously initialized by either macro without an intervening invocation of the va_end macro for the same va_list (7. |
1515 135 135135 |
| The |
parameter parmN of a | 136 declared with the register storage class, with a function or array type, or with a type that is not compatible with the type that results after application of the default argument promotions (7.15.1.4). invoked with additional arguments that include unbalanced parentheses, or unrecognized preprocessing tokens (7.16.1.4). |
|
|
| The macro definition of a generic function is suppressed to access an actual function (7.17.1, 7.18). |
|
|
136136 member designator type parameter of an offsetof macro |
is an invalid right operand of the . operator for the type parameter, or designates a bit-field 17 137 EXP38-C | 137137 The argument in an instance of one of the integer-constant macros is not a decimal, octal, or hexadecimal constant, or it has a value that exceeds the limits for the corresponding type (7.18.4). | | 138 |
| When program execution reaches an unreachable() macro invocation (7.21.1). |
|
|
138138 A byte input/output function is applied to a wide-oriented stream, or a wide character input/output function is applied to a byte-oriented stream (7.19 |
| Arbitrarily copying or changing the bytes of or copying from a non-null pointer into a nullptr_t object and then reading that object (7.21.2). |
139 139139 Use is made of any portion of a file beyond the most recent wide character written to a wide-oriented stream (7.19.2). | | 140 |
| The member designator parameter of an offsetof macro is an invalid right operand of the . operator for the type parameter, or designates a bit-field (7.21). |
|
|
140140 |
| The |
value of a pointer to a FILE object is used after the associated file is closed (7.19.3). argument in an instance of one of the integer-constant macros is not a decimal, octal, or hexadecimal constant, or it has a value that exceeds the limits for the corresponding type (7.22.4). |
|
|
| A byte input/output function is applied to a wide-oriented stream, or a wide character input/output function is applied to a byte-oriented stream (7.23.2). |
|
|
| Use is made of any portion of a file beyond the most recent wide character written to a wide-oriented stream (7.23.2). |
|
|
| The value of a pointer to a FILE object is used after the associated file is closed (7.23.3). | FIO46-C |
|
| The stream for the fflush function points to an input stream or to an update stream in which the most recent operation was input (7.23.5.2). |
|
| 
| The |
| 141 | Anchor |
|---|
ub_141 | ub_141 | The stream for the fflush function points to an input stream or to an update stream in which the most recent operation was input (7.19.5.2). | | 142 | Anchor |
|---|
ub_142 | ub_142 | The string pointed to by the mode argument in a call to the fopen function does not exactly match one of the specified character sequences (7. |
19 143 143143 |
| An output operation on an update stream is followed by an input operation without an intervening call to the fflush function or a file positioning function, or an input operation on an update stream is followed by an output operation with an intervening call to a file positioning function (7. |
19 144 144144 |
| An attempt is made to use the contents of the array that was supplied in a call to the setvbuf function (7. |
19 145 145145 |
| There are insufficient arguments for the format in a call to one of the formatted input/output functions, or an argument does not have an appropriate type (7. |
19192424 146 146146 |
| The format in a call to one of the formatted input/output functions or to the strftime or wcsftime function is not a valid multibyte character sequence that begins and ends in its initial shift |
state 191923242424 147 | 147147 |
| In a call to one of the formatted output functions, a precision appears with a conversion specifier other than those described (7. |
1924 148 148148 |
| A conversion specification for a formatted output function uses an asterisk to denote an argument-supplied field width or precision, but the corresponding argument is not provided (7. |
1924 149 | 149149 |
| A conversion specification for a formatted output function uses a # or 0 flag with a conversion specifier other than those described (7. |
1924 150 150150 |
| A conversion specification for one of the formatted input/output functions uses a length modifier with a conversion specifier other than those described (7. |
19192424 151 151151 |
| An s conversion specifier is encountered by one of the formatted output functions, and the argument is missing the null terminator (unless a precision is specified that does not require null termination) (7. |
1924 152 | 152152 Annconversion |
| An n conversion specification for one of the formatted input/output functions includes any flags, an assignment-suppressing character, a field width, or a precision (7. |
1919 72424 153 | 153153 |
| A % conversion specifier is encountered by one of the formatted input/output functions, but the complete conversion specification is not exactly %% (7. |
19192424 154 154154 |
| An |
inv alid invalid conversion specification is found in the format for one of the formatted input/output functions, or the strftime or wcsftime function (7. |
19192324 72424 155 155155 |
| The number of characters or wide characters transmitted by a formatted output function (or written to an array, or that would have been written to an array) is greater than INT_MAX (7. |
1919.6.3, 7.19.6.8, 7.19.6.10). | | 31.2.1). |
|
|
| The number of input items assigned by a formatted input function is greater than INT_MAX (7.23.6.2, 7.31.2.2). |
|
|
|
156 | Anchor |
|---|
ub_156 | ub_156 | The result of a conversion by one of the formatted input functions cannot be represented in the corresponding object, or the receiving object does not have an appropriate type (7. |
1924 | <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="59e061be-911b-4ff4-b7a8-f444e407634b"><ac:plain-text-body><![CDATA[ | 157 | Anchor |
|---|
ub_157 | ub_157 | A c, s, or [ conversion specifier is encountered by one of the formatted input functions, and the array pointed to by the corresponding argument is not large enough to accept the input sequence (and a null terminator if the conversion specifier is s or [) (7.19.6.2, 7.24.2.2). | | ]]></ac:plain-text-body></ac:structured-macro> |
|
|
| A c, s, or [ conversion specifier is encountered by one of the formatted input functions, and the array pointed to by the corresponding argument is not large enough to accept the input sequence (and a null terminator if the conversion specifier is s or [) (7.23.6.2, 7.31.2.2). |
|
|
| A c, s, or [ conversion specifier with an l qualifier is encountered by one of the formatted input functions, but the input is not a valid multibyte character sequence that begins in the initial shift state (7.23.6.2, 7.31.2.2). |
|
|
| The input item for a %p conversion by one of the formatted input functions is not a value converted earlier during the same program execution (7.23.6.2, 7.31.2.2). |
|
|
| The vfprintf, vfscanf, vprintf, vscanf, vsnprintf, vsprintf, vsscanf, vfwprintf, vfwscanf, vswprintf, vswscanf, vwprintf, or vwscanf function is called with an improperly initialized va_list argument, or the argument is used (other than in an invocation of va_end) after the function returns (7.23.6.8, 7.23.6.9, 7.23.6.10, 7.23.6.11, 7.23.6.12, 7.23.6.13, 7.23.6.14, 7.31.2.5, 7.31.2.6, 7.31.2.7, 7.31.2.8, 7.31.2.9, 7.31.2.10). |
|
|
| The contents of the array supplied in a call to the fgets, gets, or fgetws function are used after a read error occurred (7.23.7.2, 7.31.3.2). | FIO40-C |
|
| The n parameter is negative or zero for a call to fgets or fgetws. (7.23.7.2, 7.31.3.2). |
|
|
| The file position indicator for a binary stream is used after a call to the ungetc function where its value was zero before the call (7.23.7.11). |
|
|
| The file position indicator for a stream is used after an error occurred during a call to the fread or fwrite function (7.23.8.1, 7.23.8.2). |
|
|
| A partial element read by a call to the fread function is used (7.23.8.1). |
|
|
| The fseek function is called for a text stream with a nonzero offset and either the offset was not returned by a previous successful call to the ftell function on a stream associated with the same file or whence is not SEEK_SET (7.23.9.2). |
|
|
| The fsetpos function is called to set a position that was not returned by a previous successful call to the fgetpos function on a stream associated with the same file (7.23.9.3). | FIO44-C |
|
| A non-null pointer returned by a call to the calloc, malloc, realloc, or aligned_alloc function with a zero requested size is used to access an object (7.24.3). | MEM04-C |
|
| The value of a pointer that refers to space deallocated by a call to the free or realloc function is used (7.24.3). | MEM30-C |
|
| The pointer argument to the free or realloc function is unequal to a null pointer and does not match a pointer earlier returned by a memory management function, or the space has been deallocated by a call to free or realloc (7.24.3.3, 7.24.3.7). | MEM34-C |
|
| The value of the object allocated by the malloc function is used (7.24.3.4). |
|
|
| The values of any bytes in a new object allocated by the realloc function beyond the size of the old object are used (7.24.3.7). | EXP33-C |
|
| The program calls the exit or quick_exit function more than once, or calls both functions (7.24.4.4, 7.24.4.7). | ENV32-C, ERR04-C |
|
| During the call to a function registered with the atexit or at_quick_exit function, a call is made to the longjmp function that would terminate the call to the registered function (7.24.4.4, 7.24.4.7). | ENV32-C |
|
| The string set up by the getenv or strerror function is modified by the program (7.24.4.6, 7.26.6.3). | ENV30-C |
|
| A signal is raised while the quick_exit function is executing (7.24.4.7). |
|
|
| A command is executed through the system function in a way that is documented as causing termination or some other form of undefined behavior (7.24.4.8). |
|
|
| A searching or sorting utility function is called with an invalid pointer argument, even if the number of elements is zero (7.24.5). |
|
|
| The comparison function called by a searching or sorting utility function alters the contents of the array being searched or sorted, or returns ordering values inconsistently (7.24.5). |
|
|
| The array being searched by the bsearch function does not have its elements in proper order (7.24.5.1). |
|
|
| The current conversion state is used by a multibyte/wide character conversion function after changing the LC_CTYPE category (7.24.7). |
|
|
| A string or wide string utility function is instructed to access an array beyond the end of an object (7.26.1, 7.31.4). |
|
|
| A string or wide string utility function is called with an invalid pointer argument, even if the length is zero (7.26.1, 7.31.4). |
|
|
| The contents of the destination array are used after a call to the strxfrm, strftime, wcsxfrm, or wcsftime function in which the specified length was too small to hold the entire null-terminated result (7.26.4.5, 7.29.3.5, 7.31.4.4.4, 7.31.5.1). |
|
|
| A sequence of calls of the strtok function is made from different threads (7.26.5.9). |
|
|
| The first argument in the very first call to the strtok or wcstok is a null pointer (7.26.5.9, 7.31.4.5.8). |
|
|
| A pointer returned by the strerror function is used after a subsequent call to the function, or after the calling thread has exited (7.26.6.3). |
|
|
| The type of an argument to a type-generic macro is not compatible with the type of the corresponding parameter of the selected function (7.27). |
|
|
| Arguments for generic parameters of a type-generic macro are such that some argument has a corresponding real type that is of standard floating type and another argument is of decimal floating type (7.27). |
|
|
| Arguments for generic parameters of a type-generic macro are such that neither <math.h> and <complex.h> define a function whose generic parameters have the determined corresponding real type (7.27). |
|
|
| A complex argument is supplied for a generic parameter of a type-generic macro that has no corresponding complex function (7.27). |
|
|
| A decimal floating argument is supplied for a generic parameter of a type-generic macro that expects a complex argument (7.27). |
|
|
| A standard floating or complex argument is supplied for a generic parameter of a type-generic macro that expects a decimal floating type argument (7.27). |
|
|
| A non-recursive mutex passed to mtx_lock is locked by the calling thread (7.28.4.3). |
|
|
| The mutex passed to mtx_timedlock does not support timeout (7.28.4.4). |
|
|
| The mutex passed to mtx_unlock is not locked by the calling thread (7.28.4.6). |
|
|
| The thread passed to thrd_detach or thrd_join was previously detached or joined with another thread (7.28.5.3, 7.28.5.6). |
|
|
| The tss_create function is called from within a destructor (7.28.6.1). |
|
|
| The key passed to tss_delete, tss_get, or tss_set was not returned by a call to tss_create before the thread commenced executing destructors (7.28.6.2, 7.28.6.3, 7.28.6.4). |
|
|
| An attempt is made to access the pointer returned by the time conversion functions after the thread that originally called the function to obtain it has exited (7.29.3). |
|
|
| At least one member of the broken-down time passed to asctime contains a value outside its normal range, or the calculated year exceeds four digits or is less than the year 1000 (7.29.3.1). |
|
|
|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3c9d179a-4e01-4101-b453-912ed627e7f4"><ac:plain-text-body><![CDATA[ | 158 | Anchor |
|---|
ub_158 | ub_158 | A c, s, or [ conversion specifier with an l qualifier is encountered by one of the formatted input functions, but the input is not a valid multibyte character sequence that begins in the initial shift state (7.19.6.2, 7.24.2.2). | | ]]></ac:plain-text-body></ac:structured-macro> | 159 | Anchor |
|---|
ub_159 | ub_159 | The input item for a %p conversion by one of the formatted input functions is not a value converted earlier during the same program execution (7.19.6.2, 7.24.2.2). | | 160 | Anchor |
|---|
ub_160 | ub_160 | The vfprintf, vfscanf, vprintf, vscanf, vsnprintf, vsprintf, vsscanf, vfwprintf, vfwscanf, vswprintf, vswscanf, vwprintf, or vwscanf function is called with an improperly initialized va_list argument, or the argument is used (other than in an invocation of va_end) after the function returns (7.19.6.8, 7.19.6.9, 7.19.6.10, 7.19.6.11, 7.19.6.12, 7.19.6.13, 7.19.6.14, 7.24.2.5, 7.24.2.6, 7.24.2.7, 7.24.2.8, 7.24.2.9, 7.24.2.10). | | 161 | Anchor |
|---|
ub_161 | ub_161 | The contents of the array supplied in a call to the fgets, gets, or fgetws function are used after a read error occurred (7.19.7.2, 7.19.7.7, 7.24.3.2). | | 162 | Anchor |
|---|
ub_162 | ub_162 | The file position indicator for a binary stream is used after a call to the ungetc function where its value was zero before the call (7.19.7.11). | | 163 | Anchor |
|---|
ub_163 | ub_163 | The file position indicator for a stream is used after an error occurred during a call to the fread or fwrite function (7.19.8.1, 7.19.8.2). | | 164 | Anchor |
|---|
ub_164 | ub_164 | A partial element read by a call to the fread function is used (7.19.8.1). | | 165 | Anchor |
|---|
ub_165 | ub_165 | The fseek function is called for a text stream with a nonzero offset and either the offset was not returned by a previous successful call to the ftell function on a stream associated with the same file or whence is not SEEK_SET (7.19.9.2). | | 166 | Anchor |
|---|
ub_166 | ub_166 | The fsetpos function is called to set a position that was not returned by a previous successful call to the fgetpos function on a stream associated with the same file (7.19.9.3). | | 167 | Anchor |
|---|
ub_167 | ub_167 | A non-null pointer returned by a call to the calloc, malloc, or realloc function with a zero requested size is used to access an object (7.20.3). | | 168 | Anchor |
|---|
ub_168 | ub_168 | The value of a pointer that refers to space deallocated by a call to the free or realloc function is used (7.20.3). | | 169 | Anchor |
|---|
ub_169 | ub_169 | The pointer argument to the free or realloc function does not match a pointer earlier returned by calloc, malloc, or realloc, or the space has been deallocated by a call to free or realloc (7.20.3.2, 7.20.3.4). | MEM31-C | 170 | Anchor |
|---|
ub_170 | ub_170 | The value of the object allocated by the malloc function is used (7.20.3.3). | | 171 | Anchor |
|---|
ub_171 | ub_171 | The value of any bytes in a new object allocated by the realloc function beyond the size of the old object are used (7.20.3.4). | | 172 | Anchor |
|---|
ub_172 | ub_172 | The program executes more than one call to the exit function (7.20.4.3). | | 173 | Anchor |
|---|
ub_173 | ub_173 | During the call to a function registered with the atexit function, a call is made to the longjmp function that would terminate the call to the registered function (7.20.4.3). | | 174 | Anchor |
|---|
ub_174 | ub_174 | The string set up by the getenv or strerror function is modified by the program (7.20.4.5, 7.21.6.2). | | 175 | Anchor |
|---|
ub_175 | ub_175 | A command is executed through the system function in a way that is documented as causing termination or some other form of undefined behavior (7.20.4.6). | | 176 | Anchor |
|---|
ub_176 | ub_176 | A searching or sorting utility function is called with an invalid pointer argument, even if the number of elements is zero (7.20.5). | | 177 | Anchor |
|---|
ub_177 | ub_177 | The comparison function called by a searching or sorting utility function alters the contents of the array being searched or sorted, or returns ordering values inconsistently (7.20.5). | | 178 | Anchor |
|---|
ub_178 | ub_178 | The array being searched by the bsearch function does not have its elements in proper order (7.20.5.1). | | 179 | Anchor |
|---|
ub_179 | ub_179 | The current conversion state is used by a multibyte/wide character conversion function after changing the LC_CTYPE category (7.20.7). | | 180 | Anchor |
|---|
ub_180 | ub_180 | A string or wide string utility function is instructed to access an array beyond the end of an object (7.21.1, 7.24.4). | | 181 | Anchor |
|---|
ub_181 | ub_181 | A string or wide string utility function is called with an invalid pointer argument, even if the length is zero (7.21.1, 7.24.4). | | 182 | Anchor |
|---|
ub_182 | ub_182 | The contents of the destination array are used after a call to the strxfrm, strftime, wcsxfrm, or wcsftime function in which the specified length was too small to hold the entire null-terminated result (7.21.4.5, 7.23.3.5, 7.24.4.4.4, 7.24.5.1). | | 183 | Anchor |
|---|
ub_183 | ub_183 | The first argument in the very first call to the strtok or wcstok is a null pointer (7.21.5.8, 7.24.4.5.7). | | 184 | Anchor |
|---|
ub_184 | ub_184 | The type of an argument to a type-generic macro is not compatible with the type of the corresponding parameter of the selected function (7.22). | | 185 | Anchor |
|---|
ub_185 | ub_185 | A complex argument is supplied for a generic parameter of a type-generic macro that has no corresponding complex function (7.22). | | 186 | Anchor |
|---|
ub_186 | ub_186 | The argument corresponding to an s specifier without an l qualifier in a call to the fwprintf function does not point to a valid multibyte character sequence that begins in the initial shift state (7. |
24 187 | 187187 |
| In a call to the wcstok function, the object pointed to by ptr does not have the value stored by the previous call for the same wide string (7. |
247 188 188188 |
| An mbstate_t object is used inappropriately (7. |
24 189 189189 |
| The value of an argument of type wint_t to a wide character classification or case mapping function is neither equal to the value of WEOF nor representable as a wchar_t (7. |
25 190 | 190190 |
| The iswctype function is called using a different LC_CTYPE category from the one in effect for the call to the wctype function that returned the description (7. |
25 | 191 191191 |
| The towctrans function is called using a different LC_CTYPE category from the one in effect for the call to the wctrans function that returned the description (7. |
25 ...
