Opening and closing braces for
while statements should always be used even if the statement's body contains only a single statement.
for statement is used in a macro, the macro definition should not conclude with a semicolon. (See PRE11-C. Do not conclude macro definitions with a semicolon.)
Braces improve the uniformity and readability of code. More important, when inserting an additional statement into a body containing only a single statement, it is easy to forget to add braces because the indentation gives strong (but misleading) guidance to the structure.
Braces also help ensure that macros with multiple statements are properly expanded. Such a macro should be wrapped in a
do-while loop. (See PRE10-C. Wrap multistatement macros in a do-while loop.) However, when the
do-while loop is not present, braces can still ensure that the macro expands as intended.
Noncompliant Code Example
This noncompliant code example uses an
if statement without braces to authenticate a user:
A developer might add a debugging statement to determine when the login is valid but forget to add opening and closing braces:
Because of the indentation of the code, it is difficult to tell that the code will not function as intended by the programmer, potentially leading to a security breach.
In the compliant solution, opening and closing braces are used even when the body is a single statement:
Noncompliant Code Example
This noncompliant code example has an
if statement nested in another
if statement without braces around the
The indentation could lead the programmer to believe that a user is given administrator privileges only when the user's login is valid. However, the
else statement actually attaches to the inner
This is a security loophole: users with invalid logins can still obtain administrator privileges.
In the compliant solution, adding braces removes the ambiguity and ensures that privileges are correctly assigned:
Noncompliant Code Example (empty block)
This noncompliant code example has a
while statement with no block:
Note that if
invalid_login() has no side effects (such as warning the user if their login failed), this code also violates MSC12-C. Detect and remove code that has no effect or is never executed.
Compliant Solution (empty block)
This compliant solution features an explicit empty block, which clarifies the developer's intent:
|Axivion Bauhaus Suite|
|LDRA tool suite|
|11 S, 12 S, 428 S||Fully Implemented|
The statement forming the body of a 'switch', 'while', 'do...while' or 'for' statement shall be a compound statement
|Polyspace Bug Finder|
|CERT C: Rec. EXP19-C|
Checks for iteration or selection statement body not enclosed in braces (rec. fully covered)
|V563, V628, V640, V705|
|SonarQube C/C++ Plugin|
CVE-2014-1266 was due, in large part, to failing to follow this recommendation. There is a spurious "goto fail" statement on line 631 of sslKeyExchange.c. This "goto" gets executed unconditionally, even though it is indented as if it were part of the preceding "if" statement. As a result, the call to sslRawVerify (which performs the actual signature verification) is rendered dead code. [ImperialViolet 2014]. If the body of the "if" statement had been enclosed in braces, then this defect likely would not have happened.
|MISRA C:2012||Rule 15.6 (required)|