Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 21 Next »

For portable applications, use only the assignment = operator, the equality operators == and !=, and the unary & operator on plain character or plain wide character-typed expressions.

This is recommended because the C99 standard requires only the digit characters ('0' - '9') to have consecutive numerical values C99 N1401. Thus, operations that rely on expected values for plain character or plain wide character-typed expressions can lead to unexpected behavior.

However, due to the requirement for digit characters, the usage of other operators is allowed for them according to the following restrictions:

  • The binary + operator may be used to add integer values from 0 to 9 to '0'.
  • The binary - operator may be used to subtract character '0'.
  • Relational operators <, <=, >, >= may be used to check whether a character or wide character is a digit.

Character types should be chosen and used in accordance with STR04-C. Use plain char for characters in the basic character set.

Noncompliant code example

The following example would seem to check if the value of a character variable is between 'a' and 'c' inclusive. However, since it is not required by the C99 standard that the letter characters be consecutive nor in alphabetical order, the check might not work as expected.

char ch = 'b';
if ( ( ch >= 'a' ) && (ch <= 'c') ){
...
}

Compliant code example

In this example, the specific check is enforced using compliant operations on character expressions.

char ch = 't';
if ( ( ch == 'a' ) || ( ch == 'b') || ( ch == 'c') ){
...
}

Exceptions

It is ok to assume consecutive value for characters like a~z in most platform, where ASCII or Unicode is used. This rule is to raise awareness of platform portability, e.g., if you migrate the code from ASCII system to a non-ASII system.

Risk assesment

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

STR09-C

low

unlikely

low

P3

L3

Other Languages

This rule appears in the C++ Secure Coding Standard as [[cplusplus:STR07-CPP. Don't assume numeric values for expressions with type plain character]].

References

C99 N1401 Section 5.2.1 "Character sets"

  • No labels