Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
AzureResourceManager
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

C static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C code

Filtered: 91 rules found

cert

POSIX functions should not be called with arguments that trigger buffer overflows
Vulnerability
The address of an automatic object should not be assigned to another object that may persist after the first object has ceased to exist
Bug
Closed resources should not be accessed
Bug
Dynamically allocated memory should be released
Bug
Freed memory should not be used
Bug
Memory access should be explicitly bounded to prevent buffer overflows
Bug
Printf-style format strings should not lead to unexpected behavior at runtime
Bug
Resources should be closed
Bug
Hard-coded credentials are security-sensitive
Security Hotspot
The right-hand operands of && and || should not contain side effects
Code Smell
Trigraphs should not be used
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
Control should not be transferred into a complex logic block using a "goto" or a "switch" statement
Code Smell
Accessing files should not introduce TOCTOU vulnerabilities
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Insecure functions should not be used
Vulnerability
Function exit paths should have appropriate return values
Bug
Zero should not be a possible denominator
Bug
Pointers should not be cast to integral types
Bug
"sprintf" should not be used
Security Hotspot
Using "tmpnam", "tmpnam_s" or "tmpnam_r" is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Functions should not be defined with a variable number of arguments
Code Smell
A cast shall not remove any const or volatile qualification from the type of a pointer or reference
Code Smell
Object and function types should be explicitly stated in their declarations and definitions
Code Smell
Functions should be declared explicitly
Code Smell
"restrict" should not be used
Code Smell
Objects with integer type should not be converted to objects with pointer type
Bug
String literals with different prefixes should not be concatenated
Bug
User-defined types should not be passed as variadic arguments
Bug
Integral operations should not overflow
Bug
"sizeof" should not be called on pointers
Bug
Conditionally executed code should be reachable
Bug
Null pointers should not be dereferenced
Bug
Related "if/else if" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Variables should not be self-assigned
Bug
Using "strncpy" or "wcsncpy" is security-sensitive
Security Hotspot
Using "strncat" or "wcsncat" is security-sensitive
Security Hotspot
Using "strcat" or "wcscat" is security-sensitive
Security Hotspot
Using "strlen" or "wcslen" is security-sensitive
Security Hotspot
Using "strcpy" or "wcscpy" is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Bit fields should be declared with appropriate types
Code Smell
Atomic types should be used instead of "volatile" types
Code Smell
Format strings should be used correctly
Code Smell
Multiline blocks should be enclosed in curly braces
Code Smell
Boolean expressions should not be gratuitous
Code Smell
Obsolete POSIX functions should not be used
Code Smell
Unused assignments should be removed
Code Smell
Unused function parameters should be removed
Code Smell
Assignments should not be made from within conditions
Code Smell
Variables should not be shadowed
Code Smell
Unused labels should be removed
Code Smell
"nonnull" pointers should not be set to null
Bug
"for" loop counters should not have essentially floating type
Bug
Using hardcoded IP addresses is security-sensitive
Security Hotspot
Literal suffix "L" for long integers shall be upper case
Code Smell
Macros should not be used as replacements for "typedef" and "using"
Code Smell
Declarations should not be empty
Code Smell
Code annotated as deprecated should not be used
Code Smell
"#pragma warning (default: ...)" should not be used
Code Smell
Multiple variables should not be declared on the same line
Code Smell
Empty statements should be removed
Code Smell
"/*" and "//" should not be used within comments
Code Smell
Reserved identifiers and functions in the C standard library should not be defined or declared
Code Smell
Octal values should not be used
Code Smell
"abort", "exit", "getenv" and "system" from <stdlib.h> should not be used
Bug
"atof", "atoi" and "atol" from <stdlib.h> should not be used
Bug
"setjmp" and "longjmp" should not be used
Code Smell
Function-like macros should not be used
Code Smell
Functions without parameters should be declared with parameter type "void"
Code Smell
"switch" statements should have "default" clauses
Code Smell
"if ... else if" constructs should end with "else" clauses
Code Smell
Control structures should use curly braces
Code Smell
The number of arguments passed to a function should match the number of parameters
Bug
Bitwise operators should not be applied to signed operands
Bug
Boolean operations should not have numeric operands, and vice versa
Bug
Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression
Code Smell
Limited dependence should be placed on operator precedence
Code Smell
Array declarations should include an explicit size specification
Code Smell
Identifiers should not be longer than 31 characters
Code Smell
All uses of the #pragma directive should be documented
Code Smell
Signed and unsigned types should not be mixed in expressions
Code Smell
Appropriate char types should be used for character and integer values
Code Smell
Comment styles "//" and "/* ... */" should not be mixed within a file
Code Smell
File names should comply with a naming convention
Code Smell

String literals with different prefixes should not be concatenated

Bug

MajorSonarSource default severity
click to learn more

based-on-misra
cert

Why is this an issue?

Concatenation of wide and narrow string literals has not always been supported in C or C++, and even when supported, the meaning may be unclear to the reader. Concatenation of string literals with different encodings is only conditionally supported, and may be removed in a future version of the language.

Therefore, only string literals with the same prefix should be concatenated together.

Noncompliant code example

wchar_t n_array[] = "Hello" L"World";     // Noncompliant
wchar_t w_array[] = L"Hello" "World";     // Noncompliant

Compliant solution

char_t n_array[] = "Hello" "World";     // Compliant
wchar_t w_array[] = L"Hello" L"World";	// Compliant

Resources

MISRA C++:2008, 2-13-5 - Narrow and wide string literals shall not be concatenated.
CERT STR10-C. - Do not concatenate different type of string literals

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Developer
Edition

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted