SEI CERT C Coding Standard

Space shortcuts

Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 63 Next »

Use visually distinct identifiers with meaningful names to eliminate errors resulting from misreading the spelling of an identifier during the development and review of code. An identifier can denote an object; a function; a tag or a member of a structure, union, or enumeration; a typedef name; a label name; a macro name; or a macro parameter.

Depending on the fonts used, certain characters appear visually similar or even identical:

Symbol

Similar Symbols

0 (zero)

O (capital o), Q (capital q), D (capital d)

1 (one)

I (capital i), l (lowercase L)

2 (two)

Z (capital z)

5 (five)

S (capital s)

8 (eight)

B (capital b)

n (lowercase N)

h (lowercase H)

rn (lowercase R, lowercase N)

m (lowercase M)

Do not define multiple identifiers that vary only with respect to one or more visually similar characters.

Make the initial portions of long identifiers unique for easier recognition. This also helps prevent errors resulting from non-unique identifiers. (See rule DCL32-C. Guarantee that mutually visible identifiers are unique.)

In addition, the larger the scope of an identifier, the more descriptive should be its name. It may be perfectly appropriate to name a loop control variable i but the same name would likely be confusing if it named a file scope object or a variable local to a function more than a few lines long. See also recommendations DCL01-C. Do not reuse variable names in subscopes and DCL19-C. Use as minimal a scope as possible for all variables and functions.

Risk Assessment

Failing to use visually distinct identifiers can result in referencing the wrong object or function, causing unintended program behavior.

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

DCL02-C

low

unlikely

medium

P2

L3

Automated Detection

Tool

Version

Checker

Description

Compass/Rose

 

 

 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

CERT C++ Secure Coding Standard: DCL02-CPP. Use visually distinct identifiers

The CERT Oracle Secure Coding Standard for Java: DCL00-J. Use visually distinct identifiers

ISO/IEC 9899:1999 Section 5.2.4.1, "Translation limits"

ISO/IEC TR 24772 "AJN Choice of Filenames and other External Identifiers," "BRS Leveraging human experience," and "NAI Choice of Clear Names"

MISRA Rule 5.6

Bibliography

      02. Declarations and Initialization (DCL)      

  • No labels