SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C

C static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C code

  • All rules 315
  • Vulnerability13
  • Bug76
  • Security Hotspot19
  • Code Smell207

  • Quick Fix 19
Filtered: 34 rules found
pitfall
    Impact
      Clean code attribute
        1. "goto" should jump to labels declared later in the same function

           Code Smell
        2. Dynamic heap memory allocation should not be used

           Bug
        3. "setjmp" and "longjmp" should not be used

           Code Smell
        4. Macros should not be #define'd or #undef'd within a block

           Code Smell
        5. Object declarations should contain no more than 2 levels of pointer indirection

           Code Smell
        6. Functions without parameters should be declared with parameter type "void"

           Code Smell
        7. Recursion should not be used

           Code Smell
        8. Functions should not be defined with a variable number of arguments

           Code Smell
        9. Constants of unsigned type should have a "U" suffix

           Code Smell
        10. If a function has internal linkage then all re-declarations shall include the static storage class specifer

           Code Smell
        11. Literal suffix "L" for long integers shall be upper case

           Code Smell
        12. Macro arguments should not contain preprocessing directives

           Bug
        13. All the elements of an aggregate should be provided with an initial value

           Code Smell
        14. Macros should not be used as replacements for "typedef" and "using"

           Code Smell
        15. Keywords shall not be used as macros identifiers

           Code Smell
        16. Logical operators should not be confused with bitwise operators

           Code Smell
        17. Include directives should not rely on non-portable search strategy

           Code Smell
        18. "#include" paths should be portable

           Code Smell
        19. Array indices should be placed between brackets

           Code Smell
        20. Bit fields should not be used

           Code Smell
        21. Conditionally executed code should be reachable

           Bug
        22. Control characters should not be used in literals

           Code Smell
        23. Octal and hexadecimal escape sequences should be terminated

           Code Smell
        24. Preprocessor directives should not be indented

           Code Smell
        25. "goto" statements should not be used to jump into blocks

           Code Smell
        26. Related "if/else if" statements should not have the same condition

           Bug
        27. "static" should not be used for the size of an array parameter

           Code Smell
        28. "switch" statements should not be nested

           Code Smell
        29. The sign of an unsigned variable should not be tested

           Code Smell
        30. Octal values should not be used

           Code Smell
        31. "for" loop stop conditions should be invariant

           Code Smell
        32. Control structures should use curly braces

           Code Smell
        33. Variables should not be shadowed

           Code Smell
        34. Control should not be transferred into a complex logic block using a "goto" or a "switch" statement

           Code Smell

        Control structures should use curly braces

        intentionality - clear
        maintainability
        Code Smell
        • based-on-misra
        • cert
        • pitfall

        Control structures are code statements that impact the program’s control flow (e.g., if statements, for loops, etc.)

        Why is this an issue?

        More Info

        While not technically incorrect, the omission of curly braces can be misleading and may lead to the introduction of errors during maintenance.

        In the following example, the two calls seem to be attached to the if statement, but only the first one is, and checkSomething will always be executed:

        if (condition)  // Noncompliant
          executeSomething();
          checkSomething();
        

        Adding curly braces improves the code readability and its robustness:

        if (condition) {
          executeSomething();
          checkSomething();
        }
        

        The rule raises an issue when a control structure has no curly braces.

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use