DCL36-C. Do not declare an identifier with conflicting linkage classifications

An identifier declared in different scopes or multiple times within the same scope can be made to refer to the same object or function by linkage. An identifier can be classified as externally linked, internally linked, or not linked. These three kinds of linkage have the following characteristics [[Kirch-Prinz 02]]:

• External linkage. An identifier with external linkage represents the same object or function throughout the entire program, that is, in all compilation units and libraries belonging to the program. The identifier is available to the linker. When a second declaration of the same identifier with external linkage occurs, the linker associates the identifier with the same object or function.

• Internal linkage. An identifier with internal linkage represents the same object or function within a given translation unit. The linker has no information about identifiers with internal linkage. Consequently, these identifiers are internal to the translation unit.

• No linkage. If an identifier has no linkage, then any further declaration using the identifier declares something new, such as a new variable or a new type.

According to C99 [[ISO/IEC 9899:1999]], linkage is determined as follows:

If the declaration of a file scope identifier for an object or a function contains the storage class specifier static, the identifier has internal linkage.

For an identifier declared with the storage-class specifier extern in a scope in which a prior declaration of that identifier is visible, if the prior declaration specifies internal or external linkage, the linkage of the identifier at the later declaration is the same as the linkage specified at the prior declaration. If no prior declaration is visible, or if the prior declaration specifies no linkage, then the identifier has external linkage.

If the declaration of an identifier for a function has no storage-class specifier, its linkage is determined exactly as if it were declared with the storage-class specifier extern. If the declaration of an identifier for an object has file scope and no storage-class specifier, its linkage is external.

The following identifiers have no linkage: an identifier declared to be anything other than an object or a function; an identifier declared to be a function parameter; a block scope identifier for an object declared without the storage-class specifier extern.

Use of an identifier (within one translation unit) classified as both internally and externally linked causes undefined behavior. A translation unit includes the source file together with its headers and all source files included via the preprocessing directive #include.

Noncompliant Code Example

In this noncompliant code example, i2 and i5 are defined as having both internal and external linkage. Future use of either identifier results in undefined behavior.

int i1 = 10;  /* definition, external linkage */
static int i2 = 20;  /* definition, internal linkage */
extern int i3 = 30;  /* definition, external linkage */
int i4;  /* tentative definition, external linkage */
static int i5;  /* tentative definition, internal linkage */

int i1;  /* valid tentative definition */
int i2;  /* not valid, linkage disagreement with previous */
int i3;  /* valid tentative definition */
int i4;  /* valid tentative definition */
int i5;  /* not valid, linkage disagreement with previous */

int main(void) {
  /* ... */
}

Implementation Details

Both Microsoft Visual Studio 2003 and Microsoft Visual Studio 2005 compile this noncompliant code example without warning even at the highest diagnostic levels. Microsoft Visual Studio 2008 does provide warnings at the default warning level. The GCC compiler generates a fatal diagnostic for the conflicting definitions of i2 and i5.

Compliant Solution

This compliant solution does not include conflicting definitions.

int i1 = 10;  /* definition, external linkage */
static int i2 = 20;  /* definition, internal linkage */
extern int i3 = 30;  /* definition, external linkage */
int i4;  /* tentative definition, external linkage */
static int i5;  /* tentative definition, internal linkage */

int main(void) {
  /* ... */
}

Risk Assessment

Use of an identifier classified as both internally and externally linked causes undefined behavior.

Automated Detection

The LDRA tool suite Version 7.6.0 can detect violations of this rule.

Splint Version 3.1.1 can detect violations of this rule.

GCC Compiler Version 4.4.0 can detect violations of this rule.

Klocwork Version 8.0.4.16 can detect violations of this rule with the IF_DEF_IN_HEADER_DECL and IF_MULTI_DECL checkers.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

This rule appears in the C++ Secure Coding Standard as DCL36-CPP. Do not declare an identifier with conflicting linkage classifications.

References

[[Banahan 03]] Section 8.2, "Declarations, Definitions and Accessibility"
[[ISO/IEC 9899:1999]] Section 6.2.2, "Linkages of identifiers"
[[Kirch-Prinz 02]]
[[MISRA 04]] Rule 8.1

DCL35-C. Do not invoke a function using a type that does not match the function definition      02. Declarations and Initialization (DCL)       03. Expressions (EXP)