Two consecutive question marks signify the start of a trigraph sequence.

According to the C99 Standard:

All occurrences in a source file of the following sequences of three characters (ie. trigraph sequences) are replaced with the corresponding single character.

??=	#		??)	]		??!	|
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0c91bfd5-42d6-4ace-bffe-38eade3e5c5b"><ac:plain-text-body><![CDATA[	??(	[		??'	^		??>	}	]]></ac:plain-text-body></ac:structured-macro>
??/	\		??<	{		??-	~

Non-compliant Code Example

In this non-compliant code example, a++ will not be executed, as the trigraph sequence ??/ will be replaced by \, logically putting a++ on the same line as the comment.

// what is the value of a now??/
a++;

Compliant Solution

Trigraph sequences can be successfully used for multi-line comments.

/??/
* what is the value of a now? *??/
/
a++;

Non-compliant Code Example

This non-compliant code has the trigraph sequence of ??! included, which will be replaced by the character |.

size_t i;
/* assignment of i */
if (i > 9000) {
   puts("Over 9000!??!");
}

The above code will print out Over 9000!| if a C99 Compliant compiler is used.

Compliant Solution

The compliant solution uses string concatenation to place the two question marks together, as they will be interpreted as beginning a trigraph sequence otherwise.

size_t i;
/* assignment of i */
if (i > 9000) {
   puts("Over 9000!?""?!");
}

The above code will print out Over 9000!??!, as intended.

Risk Assessment

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Section 5.2.1.1, "Trigraph sequences"
\[Wikipedia\] ["C Trigraphs"|http://en.wikipedia.org/wiki/C_trigraph]