Skip to content

Commit 3600dc5

Browse files
kroeningkroening
committedSep 5, 2023
HTML version of Appendix J.2 of N1570 with status
This adds an HTML table of Appendix J.2 of N1570 with a column "checked" to track the instances of C11 undefined behavior that CBMC can check.
·
cbmc-6.6.0cbmc-5.93.0
1 parent 20d6c8c commit 3600dc5

File tree

1 file changed

+1334
-0
lines changed

1 file changed

+1334
-0
lines changed
 

‎doc/C/c11-undefined-behavior.html

Lines changed: 1334 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,1334 @@
1+
<html>
2+
3+
<p>
4+
This follows appendix J.2 ("Undefined behavior") of <a
5+
href="https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf">N1570</a>
6+
(C11) precisely. All meanings are as in the standard.
7+
</p>
8+
9+
<style>
10+
td { vertical-align: top; }
11+
th { text-align: left; }
12+
</style>
13+
14+
<table style="">
15+
16+
<tr><th width="50%">C11 J.2</th>
17+
<th>Checked?</th>
18+
</tr>
19+
20+
<tr><td>
21+
&ndash; A &ldquo;shall&rdquo; or &ldquo;shall not&rdquo; requirement that appears outside of a constraint is violated
22+
(clause 4).</td>
23+
<td>no</td>
24+
</tr>
25+
26+
<tr><td>
27+
&ndash; A nonempty source file does not end in a new-line character which is not immediately
28+
preceded by a backslash character or ends in a partial preprocessing token or
29+
comment (5.1.1.2).</td>
30+
<td>no</td>
31+
</tr>
32+
33+
<tr><td>
34+
&ndash; Token concatenation produces a character sequence matching the syntax of a
35+
universal character name (5.1.1.2).</td>
36+
<td>no</td>
37+
</tr>
38+
39+
<tr><td>
40+
&ndash; A program in a hosted environment does not define a function named main using one
41+
of the specified forms (5.1.2.2.1).</td>
42+
<td>no</td>
43+
</tr>
44+
45+
<tr><td>
46+
&ndash; The execution of a program contains a data race (5.1.2.4).</td>
47+
<td>no</td>
48+
</tr>
49+
50+
<tr><td>
51+
&ndash; A character not in the basic source character set is encountered in a source file, except
52+
in an identifier, a character constant, a string literal, a header name, a comment, or a
53+
preprocessing token that is never converted to a token (5.2.1).</td>
54+
<td>no</td>
55+
</tr>
56+
57+
<tr><td>
58+
&ndash; An identifier, comment, string literal, character constant, or header name contains an
59+
invalid multibyte character or does not begin and end in the initial shift state (5.2.1.2).</td>
60+
<td>no</td>
61+
</tr>
62+
63+
<tr><td>
64+
&ndash; The same identifier has both internal and external linkage in the same translation unit
65+
(6.2.2).</td>
66+
<td>no</td>
67+
</tr>
68+
69+
<tr><td>
70+
&ndash; An object is referred to outside of its lifetime (6.2.4).</td>
71+
<td>yes</td>
72+
</tr>
73+
74+
<tr><td>
75+
&ndash; The value of a pointer to an object whose lifetime has ended is used (6.2.4).</td>
76+
<td>no</td>
77+
</tr>
78+
79+
<tr><td>
80+
&ndash; The value of an object with automatic storage duration is used while it is
81+
indeterminate (6.2.4, 6.7.9, 6.8).</td>
82+
<td>no</td>
83+
</tr>
84+
85+
<tr><td>
86+
&ndash; A trap representation is read by an lvalue expression that does not have character type
87+
(6.2.6.1).</td>
88+
<td>no</td>
89+
</tr>
90+
91+
<tr><td>
92+
&ndash; A trap representation is produced by a side effect that modifies any part of the object
93+
using an lvalue expression that does not have character type (6.2.6.1).</td>
94+
<td>no</td>
95+
</tr>
96+
97+
<tr><td>
98+
&ndash; The operands to certain operators are such that they could produce a negative zero
99+
result, but the implementation does not support negative zeros (6.2.6.2).</td>
100+
<td>no</td>
101+
</tr>
102+
103+
<tr><td>
104+
&ndash; Two declarations of the same object or function specify types that are not compatible
105+
(6.2.7).</td>
106+
<td>yes</td>
107+
</tr>
108+
109+
<tr><td>
110+
&ndash; A program requires the formation of a composite type from a variable length array
111+
type whose size is specified by an expression that is not evaluated (6.2.7).</td>
112+
<td>no</td>
113+
</tr>
114+
115+
<tr><td>
116+
&ndash; Conversion to or from an integer type produces a value outside the range that can be
117+
represented (6.3.1.4).</td>
118+
<td>yes</td>
119+
</tr>
120+
121+
<tr><td>
122+
&ndash; Demotion of one real floating type to another produces a value outside the range that
123+
can be represented (6.3.1.5).</td>
124+
<td>no</td>
125+
</tr>
126+
127+
<tr><td>
128+
&ndash; An lvalue does not designate an object when evaluated (6.3.2.1).</td>
129+
<td>yes</td>
130+
</tr>
131+
132+
<tr><td>
133+
&ndash; A non-array lvalue with an incomplete type is used in a context that requires the value
134+
of the designated object (6.3.2.1).</td>
135+
<td>no</td>
136+
</tr>
137+
138+
<tr><td>
139+
&ndash; An lvalue designating an object of automatic storage duration that could have been
140+
declared with the register storage class is used in a context that requires the value
141+
of the designated object, but the object is uninitialized. (6.3.2.1).</td>
142+
<td>no</td>
143+
</tr>
144+
145+
<tr><td>
146+
&ndash; An lvalue having array type is converted to a pointer to the initial element of the
147+
array, and the array object has register storage class (6.3.2.1).</td>
148+
<td>no</td>
149+
</tr>
150+
151+
<tr><td>
152+
&ndash; An attempt is made to use the value of a void expression, or an implicit or explicit
153+
conversion (except to void) is applied to a void expression (6.3.2.2).</td>
154+
<td>yes</td>
155+
</tr>
156+
157+
<tr><td>
158+
&ndash; Conversion of a pointer to an integer type produces a value outside the range that can
159+
be represented (6.3.2.3).</td>
160+
<td>no</td>
161+
</tr>
162+
163+
<tr><td>
164+
&ndash; Conversion between two pointer types produces a result that is incorrectly aligned
165+
(6.3.2.3).</td>
166+
<td>no</td>
167+
</tr>
168+
169+
<tr><td>
170+
&ndash; A pointer is used to call a function whose type is not compatible with the referenced
171+
type (6.3.2.3).</td>
172+
<td>no</td>
173+
</tr>
174+
175+
<tr><td>
176+
&ndash; An unmatched ' or " character is encountered on a logical source line during
177+
tokenization (6.4).</td>
178+
<td>yes</td>
179+
</tr>
180+
181+
<tr><td>
182+
&ndash; A reserved keyword token is used in translation phase 7 or 8 for some purpose other
183+
than as a keyword (6.4.1).</td>
184+
<td>no</td>
185+
</tr>
186+
187+
<tr><td>
188+
&ndash; A universal character name in an identifier does not designate a character whose
189+
encoding falls into one of the specified ranges (6.4.2.1).</td>
190+
<td>no</td>
191+
</tr>
192+
193+
<tr><td>
194+
&ndash; The initial character of an identifier is a universal character name designating a digit
195+
(6.4.2.1).</td>
196+
<td>no</td>
197+
</tr>
198+
199+
<tr><td>
200+
&ndash; Two identifiers differ only in nonsignificant characters (6.4.2.1).</td>
201+
<td>no</td>
202+
</tr>
203+
204+
<tr><td>
205+
&ndash; The identifier <code>__func__</code> is explicitly declared (6.4.2.2).</td>
206+
<td>no</td>
207+
</tr>
208+
209+
<tr><td>
210+
&ndash; The program attempts to modify a string literal (6.4.5).</td>
211+
<td>yes</td>
212+
</tr>
213+
214+
<tr><td>
215+
&ndash; The characters ', \, ", //, or /* occur in the sequence between the &lt; and &gt;
216+
delimiters, or the characters ', \, //, or /* occur in the sequence between the "
217+
delimiters, in a header name preprocessing token (6.4.7).</td>
218+
<td>no</td>
219+
</tr>
220+
221+
<tr><td>
222+
&ndash; A side effect on a scalar object is unsequenced relative to either a different side effect
223+
on the same scalar object or a value computation using the value of the same scalar
224+
object (6.5).</td>
225+
<td>no</td>
226+
</tr>
227+
228+
<tr><td>
229+
&ndash; An exceptional condition occurs during the evaluation of an expression (6.5).</td>
230+
<td>yes</td>
231+
</tr>
232+
233+
<tr><td>
234+
&ndash; An object has its stored value accessed other than by an lvalue of an allowable type
235+
(6.5).</td>
236+
<td>no</td>
237+
</tr>
238+
239+
<tr><td>
240+
&ndash; For a call to a function without a function prototype in scope, the number of
241+
arguments does not equal the number of parameters (6.5.2.2).</td>
242+
<td>no</td>
243+
</tr>
244+
245+
<tr><td>
246+
&ndash; For call to a function without a function prototype in scope where the function is
247+
defined with a function prototype, either the prototype ends with an ellipsis or the
248+
types of the arguments after promotion are not compatible with the types of the
249+
parameters (6.5.2.2).</td>
250+
<td>no</td>
251+
</tr>
252+
253+
<tr><td>
254+
&ndash; For a call to a function without a function prototype in scope where the function is not
255+
defined with a function prototype, the types of the arguments after promotion are not
256+
compatible with those of the parameters after promotion (with certain exceptions)
257+
(6.5.2.2).</td>
258+
<td>no</td>
259+
</tr>
260+
261+
<tr><td>
262+
&ndash; A function is defined with a type that is not compatible with the type (of the
263+
expression) pointed to by the expression that denotes the called function (6.5.2.2).</td>
264+
<td>no</td>
265+
</tr>
266+
267+
<tr><td>
268+
&ndash; A member of an atomic structure or union is accessed (6.5.2.3).</td>
269+
<td>no</td>
270+
</tr>
271+
272+
<tr><td>
273+
&ndash; The operand of the unary * operator has an invalid value (6.5.3.2).</td>
274+
<td>yes</td>
275+
</tr>
276+
277+
<tr><td>
278+
&ndash; A pointer is converted to other than an integer or pointer type (6.5.4).</td>
279+
<td>yes</td>
280+
</tr>
281+
282+
<tr><td>
283+
&ndash; The value of the second operand of the / or % operator is zero (6.5.5).</td>
284+
<td>yes</td>
285+
</tr>
286+
287+
<tr><td>
288+
&ndash; Addition or subtraction of a pointer into, or just beyond, an array object and an
289+
integer type produces a result that does not point into, or just beyond, the same array
290+
object (6.5.6).</td>
291+
<td>no</td>
292+
</tr>
293+
294+
<tr><td>
295+
&ndash; Addition or subtraction of a pointer into, or just beyond, an array object and an
296+
integer type produces a result that points just beyond the array object and is used as
297+
the operand of a unary * operator that is evaluated (6.5.6).</td>
298+
<td>yes</td>
299+
</tr>
300+
301+
<tr><td>
302+
&ndash; Pointers that do not point into, or just beyond, the same array object are subtracted
303+
(6.5.6).</td>
304+
<td>yes</td>
305+
</tr>
306+
307+
<tr><td>
308+
&ndash; An array subscript is out of range, even if an object is apparently accessible with the
309+
given subscript (as in the lvalue expression <code>a[1][7]</code> given the declaration
310+
<code int a[4][5]</code>) (6.5.6).</td>
311+
<td>yes</td>
312+
</tr>
313+
314+
<tr><td>
315+
&ndash; The result of subtracting two pointers is not representable in an object of type
316+
<code>ptrdiff_t</code> (6.5.6).</td>
317+
<td>no</td>
318+
</tr>
319+
320+
<tr><td>
321+
&ndash; An expression is shifted by a negative number or by an amount greater than or equal
322+
to the width of the promoted expression (6.5.7).</td>
323+
<td>yes</td>
324+
</tr>
325+
326+
<tr><td>
327+
&ndash; An expression having signed promoted type is left-shifted and either the value of the
328+
expression is negative or the result of shifting would be not be representable in the
329+
promoted type (6.5.7).</td>
330+
<td>yes</td>
331+
</tr>
332+
333+
<tr><td>
334+
&ndash; Pointers that do not point to the same aggregate or union (nor just beyond the same
335+
array object) are compared using relational operators (6.5.8).</td>
336+
<td>yes</td>
337+
</tr>
338+
339+
<tr><td>
340+
&ndash; An object is assigned to an inexactly overlapping object or to an exactly overlapping
341+
object with incompatible type (6.5.16.1).</td>
342+
<td>no</td>
343+
</tr>
344+
345+
<tr><td>
346+
&ndash; An expression that is required to be an integer constant expression does not have an
347+
integer type; has operands that are not integer constants, enumeration constants,
348+
character constants, sizeof expressions whose results are integer constants,
349+
<code>_Alignof</code> expressions, or immediately-cast floating constants; or contains casts
350+
(outside operands to sizeof and <code>_Alignof</code> operators) other than conversions of
351+
arithmetic types to integer types (6.6).</td>
352+
<td>yes</td>
353+
</tr>
354+
355+
<tr><td>
356+
&ndash; A constant expression in an initializer is not, or does not evaluate to, one of the
357+
following: an arithmetic constant expression, a null pointer constant, an address
358+
constant, or an address constant for a complete object type plus or minus an integer
359+
constant expression (6.6).</td>
360+
<td>yes</td>
361+
</tr>
362+
363+
<tr><td>
364+
&ndash; An arithmetic constant expression does not have arithmetic type; has operands that
365+
are not integer constants, floating constants, enumeration constants, character
366+
constants, sizeof expressions whose results are integer constants, or <code>_Alignof</code>
367+
expressions; or contains casts (outside operands to sizeof or <code>_Alignof</code> operators)
368+
other than conversions of arithmetic types to arithmetic types (6.6).</td>
369+
<td>yes</td>
370+
</tr>
371+
372+
<tr><td>
373+
&ndash; The value of an object is accessed by an array-subscript
374+
<code>[]</code>, member-access <code>.</code> or <code>-&gt;</code>,
375+
address <code>&amp;</code>, or indirection <code>*</code> operator
376+
or a pointer cast in creating an address constant (6.6).</td>
377+
<td>yes</td>
378+
</tr>
379+
380+
<tr><td>
381+
&ndash; An identifier for an object is declared with no linkage and the type of the object is
382+
incomplete after its declarator, or after its init-declarator if it has an initializer (6.7).</td>
383+
<td>no</td>
384+
</tr>
385+
386+
<tr><td>
387+
&ndash; A function is declared at block scope with an explicit storage-class specifier other
388+
than extern (6.7.1).</td>
389+
<td>no</td>
390+
</tr>
391+
392+
<tr><td>
393+
&ndash; A structure or union is defined without any named members (including those
394+
specified indirectly via anonymous structures and unions) (6.7.2.1).</td>
395+
<td>no</td>
396+
</tr>
397+
398+
<tr><td>
399+
&ndash; An attempt is made to access, or generate a pointer to just past, a flexible array
400+
member of a structure when the referenced object provides no elements for that array
401+
(6.7.2.1).</td>
402+
<td>no</td>
403+
</tr>
404+
405+
<tr><td>
406+
&ndash; When the complete type is needed, an incomplete structure or union type is not
407+
completed in the same scope by another declaration of the tag that defines the content
408+
(6.7.2.3).</td>
409+
<td>no</td>
410+
</tr>
411+
412+
<tr><td>
413+
&ndash; An attempt is made to modify an object defined with a const-qualified type through
414+
use of an lvalue with non-const-qualified type (6.7.3).</td>
415+
<td>yes</td>
416+
</tr>
417+
418+
<tr><td>
419+
&ndash; An attempt is made to refer to an object defined with a volatile-qualified type through
420+
use of an lvalue with non-volatile-qualified type (6.7.3).</td>
421+
<td>no</td>
422+
</tr>
423+
424+
<tr><td>
425+
&ndash; The specification of a function type includes any type qualifiers (6.7.3).</td>
426+
<td>no</td>
427+
</tr>
428+
429+
<tr><td>
430+
&ndash; Two qualified types that are required to be compatible do not have the identically
431+
qualified version of a compatible type (6.7.3).</td>
432+
<td>no</td>
433+
</tr>
434+
435+
<tr><td>
436+
&ndash; An object which has been modified is accessed through a restrict-qualified pointer to
437+
a const-qualified type, or through a restrict-qualified pointer and another pointer that
438+
are not both based on the same object (6.7.3.1).</td>
439+
<td>no</td>
440+
</tr>
441+
442+
<tr><td>
443+
&ndash; A restrict-qualified pointer is assigned a value based on another restricted pointer
444+
whose associated block neither began execution before the block associated with this
445+
pointer, nor ended before the assignment (6.7.3.1).</td>
446+
<td>no</td>
447+
</tr>
448+
449+
<tr><td>
450+
&ndash; A function with external linkage is declared with an inline function specifier, but is
451+
not also defined in the same translation unit (6.7.4).</td>
452+
<td>no</td>
453+
</tr>
454+
455+
<tr><td>
456+
&ndash; A function declared with a <code>_Noreturn</code> function specifier returns to its caller (6.7.4).</td>
457+
<td>no</td>
458+
</tr>
459+
460+
<tr><td>
461+
&ndash; The definition of an object has an alignment specifier and another declaration of that
462+
object has a different alignment specifier (6.7.5).</td>
463+
<td>no</td>
464+
</tr>
465+
466+
<tr><td>
467+
&ndash; Declarations of an object in different translation units have different alignment
468+
specifiers (6.7.5).</td>
469+
<td>no</td>
470+
</tr>
471+
472+
<tr><td>
473+
&ndash; Two pointer types that are required to be compatible are not identically qualified, or
474+
are not pointers to compatible types (6.7.6.1).</td>
475+
<td>no</td>
476+
</tr>
477+
478+
<tr><td>
479+
&ndash; The size expression in an array declaration is not a constant expression and evaluates
480+
at program execution time to a nonpositive value (6.7.6.2).</td>
481+
<td>yes</td>
482+
</tr>
483+
484+
<tr><td>
485+
&ndash; In a context requiring two array types to be compatible, they do not have compatible
486+
element types, or their size specifiers evaluate to unequal values (6.7.6.2).</td>
487+
<td>no</td>
488+
</tr>
489+
490+
<tr><td>
491+
&ndash; A declaration of an array parameter includes the keyword static within the
492+
<code>[</code> and <code>]</code> and the corresponding argument does not provide access to the first element of an
493+
array with at least the specified number of elements (6.7.6.3).</td>
494+
<td>no</td>
495+
</tr>
496+
497+
<tr><td>
498+
&ndash; A storage-class specifier or type qualifier modifies the keyword
499+
<code>void</code> as a function parameter type list (6.7.6.3).</td>
500+
<td>no</td>
501+
</tr>
502+
503+
<tr><td>
504+
&ndash; In a context requiring two function types to be compatible, they do not have
505+
compatible return types, or their parameters disagree in use of the ellipsis terminator
506+
or the number and type of parameters (after default argument promotion, when there
507+
is no parameter type list or when one type is specified by a function definition with an
508+
identifier list) (6.7.6.3).</td>
509+
<td>no</td>
510+
</tr>
511+
512+
<tr><td>
513+
&ndash; The value of an unnamed member of a structure or union is used (6.7.9).</td>
514+
<td>no</td>
515+
</tr>
516+
517+
<tr><td>
518+
&ndash; The initializer for a scalar is neither a single expression nor a single expression
519+
enclosed in braces (6.7.9).</td>
520+
<td>yes</td>
521+
</tr>
522+
523+
<tr><td>
524+
&ndash; The initializer for a structure or union object that has automatic storage duration is
525+
neither an initializer list nor a single expression that has compatible structure or union
526+
type (6.7.9).</td>
527+
<td>yes</td>
528+
</tr>
529+
530+
<tr><td>
531+
&ndash; The initializer for an aggregate or union, other than an array initialized by a string
532+
literal, is not a brace-enclosed list of initializers for its elements or members (6.7.9).</td>
533+
<td>yes</td>
534+
</tr>
535+
536+
<tr><td>
537+
&ndash; An identifier with external linkage is used, but in the program there does not exist
538+
exactly one external definition for the identifier, or the identifier is not used and there
539+
exist multiple external definitions for the identifier (6.9).</td>
540+
<td>no</td>
541+
</tr>
542+
543+
<tr><td>
544+
&ndash; A function definition includes an identifier list, but the types of the parameters are not
545+
declared in a following declaration list (6.9.1).</td>
546+
<td>no</td>
547+
</tr>
548+
549+
<tr><td>
550+
&ndash; An adjusted parameter type in a function definition is not a complete object type
551+
(6.9.1).</td>
552+
<td>no</td>
553+
</tr>
554+
555+
<tr><td>
556+
&ndash; A function that accepts a variable number of arguments is defined without a
557+
parameter type list that ends with the ellipsis notation (6.9.1).</td>
558+
<td>yes</td>
559+
</tr>
560+
561+
<tr><td>
562+
&ndash; The <code>}</code> that terminates a function is reached, and the value of the function call is used
563+
by the caller (6.9.1).</td>
564+
<td>no</td>
565+
</tr>
566+
567+
<tr><td>
568+
&ndash; An identifier for an object with internal linkage and an incomplete type is declared
569+
with a tentative definition (6.9.2).</td>
570+
<td>no</td>
571+
</tr>
572+
573+
<tr><td>
574+
&ndash; The token defined is generated during the expansion of a
575+
<code>#if</code> or <code>#elif</code>
576+
preprocessing directive, or the use of the defined unary operator does not match
577+
one of the two specified forms prior to macro replacement (6.10.1).</td>
578+
<td>no</td>
579+
</tr>
580+
581+
<tr><td>
582+
&ndash; The <code>#include</code> preprocessing directive that results after expansion does not match
583+
one of the two header name forms (6.10.2).</td>
584+
<td>no</td>
585+
</tr>
586+
587+
<tr><td>
588+
&ndash; The character sequence in an <code>#include</code> preprocessing directive does not start with a
589+
letter (6.10.2).</td>
590+
<td>no</td>
591+
</tr>
592+
593+
<tr><td>
594+
&ndash; There are sequences of preprocessing tokens within the list of macro arguments that
595+
would otherwise act as preprocessing directives (6.10.3).</td>
596+
<td>no</td>
597+
</tr>
598+
599+
<tr><td>
600+
&ndash; The result of the preprocessing operator <code>#</code> is not a valid character string literal
601+
(6.10.3.2).</td>
602+
<td>no</td>
603+
</tr>
604+
605+
<tr><td>
606+
&ndash; The result of the preprocessing operator <code>##</code> is not a valid preprocessing token
607+
(6.10.3.3).</td>
608+
<td>no</td>
609+
</tr>
610+
611+
<tr><td>
612+
&ndash; The <code>#line</code> preprocessing directive that results after expansion does not match one of
613+
the two well-defined forms, or its digit sequence specifies zero or a number greater
614+
than 2147483647 (6.10.4).</td>
615+
<td>no</td>
616+
</tr>
617+
618+
<tr><td>
619+
&ndash; A non-STDC <code>#pragma</code> preprocessing directive that is documented as causing
620+
translation failure or some other form of undefined behavior is encountered (6.10.6).</td>
621+
<td>no</td>
622+
</tr>
623+
624+
<tr><td>
625+
&ndash; A <code>#pragma</code> STDC preprocessing directive does not match one of the well-defined
626+
forms (6.10.6).</td>
627+
<td>no</td>
628+
</tr>
629+
630+
<tr><td>
631+
&ndash; The name of a predefined macro, or the identifier defined, is the subject of a
632+
<code>#define</code> or <code>#undef</code> preprocessing directive (6.10.8).</td>
633+
<td>no</td>
634+
</tr>
635+
636+
<tr><td>
637+
&ndash; An attempt is made to copy an object to an overlapping object by use of a library
638+
function, other than as explicitly allowed (e.g., <code>memmove</code>) (clause 7).</td>
639+
<td>yes</td>
640+
</tr>
641+
642+
<tr><td>
643+
&ndash; A file with the same name as one of the standard headers, not provided as part of the
644+
implementation, is placed in any of the standard places that are searched for included
645+
source files (7.1.2).</td>
646+
<td></td>
647+
</tr>
648+
649+
<tr><td>
650+
&ndash; A header is included within an external declaration or definition (7.1.2).</td>
651+
<td>no</td>
652+
</tr>
653+
654+
<tr><td>
655+
&ndash; A function, object, type, or macro that is specified as being declared or defined by
656+
some standard header is used before any header that declares or defines it is included
657+
(7.1.2).</td>
658+
<td>no</td>
659+
</tr>
660+
661+
<tr><td>
662+
&ndash; A standard header is included while a macro is defined with the same name as a
663+
keyword (7.1.2).</td>
664+
<td>no</td>
665+
</tr>
666+
667+
<tr><td>
668+
&ndash; The program attempts to declare a library function itself, rather than via a standard
669+
header, but the declaration does not have external linkage (7.1.2).</td>
670+
<td>no</td>
671+
</tr>
672+
673+
<tr><td>
674+
&ndash; The program declares or defines a reserved identifier, other than as allowed by 7.1.4
675+
(7.1.3).</td>
676+
<td>no</td>
677+
</tr>
678+
679+
<tr><td>
680+
&ndash; The program removes the definition of a macro whose name begins with an
681+
underscore and either an uppercase letter or another underscore (7.1.3).</td>
682+
<td>no</td>
683+
</tr>
684+
685+
<tr><td>
686+
&ndash; An argument to a library function has an invalid value or a type not expected by a
687+
function with variable number of arguments (7.1.4).</td>
688+
<td>no</td>
689+
</tr>
690+
691+
<tr><td>
692+
&ndash; The pointer passed to a library function array parameter does not have a value such
693+
that all address computations and object accesses are valid (7.1.4).</td>
694+
<td>yes</td>
695+
</tr>
696+
697+
<tr><td>
698+
&ndash; The macro definition of assert is suppressed in order to access an actual function
699+
(7.2).</td>
700+
<td>no</td>
701+
</tr>
702+
703+
<tr><td>
704+
&ndash; The argument to the assert macro does not have a scalar type (7.2).</td>
705+
<td>no</td>
706+
</tr>
707+
708+
<tr><td>
709+
&ndash; The <code>CX_LIMITED_RANGE</code>, <code>FENV_ACCESS</code>, or
710+
<code>FP_CONTRACT</code> pragma is used in
711+
any context other than outside all external declarations or preceding all explicit
712+
declarations and statements inside a compound statement (7.3.4, 7.6.1, 7.12.2).</td>
713+
<td>no</td>
714+
</tr>
715+
716+
<tr><td>
717+
&ndash; The value of an argument to a character handling function is neither equal to the value
718+
of EOF nor representable as an unsigned char (7.4).</td>
719+
<td>no</td>
720+
</tr>
721+
722+
<tr><td>
723+
&ndash; A macro definition of errno is suppressed in order to access an actual object, or the
724+
program defines an identifier with the name <code>errno</code> (7.5).</td>
725+
<td>no</td>
726+
</tr>
727+
728+
<tr><td>
729+
&ndash; Part of the program tests floating-point status flags, sets floating-point control modes,
730+
or runs under non-default mode settings, but was translated with the state for the
731+
<code>FENV_ACCESS</code> pragma &ldquo;off&rdquo; (7.6.1).</td>
732+
<td>no</td>
733+
</tr>
734+
735+
<tr><td>
736+
&ndash; The exception-mask argument for one of the functions that provide access to the
737+
floating-point status flags has a nonzero value not obtained by bitwise OR of the
738+
floating-point exception macros (7.6.2).</td>
739+
<td>no</td>
740+
</tr>
741+
742+
<tr><td>
743+
&ndash; The <code>fesetexceptflag</code> function is used to set floating-point status flags that were
744+
not specified in the call to the <code>fegetexceptflag</code> function that provided the value
745+
of the corresponding <code>fexcept_t</code> object (7.6.2.4).</td>
746+
<td>no</td>
747+
</tr>
748+
749+
<tr><td>
750+
&ndash; The argument to <code>fesetenv</code> or <code>feupdateenv</code> is neither an object set by a call to
751+
<code>fegetenv</code> or <code>feholdexcept</code>, nor is it an environment macro (7.6.4.3, 7.6.4.4).</td>
752+
<td>no</td>
753+
</tr>
754+
755+
<tr><td>
756+
&ndash; The value of the result of an integer arithmetic or conversion function cannot be
757+
represented (7.8.2.1, 7.8.2.2, 7.8.2.3, 7.8.2.4, 7.22.6.1, 7.22.6.2, 7.22.1).</td>
758+
<td>yes</td>
759+
</tr>
760+
761+
<tr><td>
762+
&ndash; The program modifies the string pointed to by the value returned by the
763+
<code>setlocale</code> function (7.11.1.1).</td>
764+
<td>no</td>
765+
</tr>
766+
767+
<tr><td>
768+
&ndash; The program modifies the structure pointed to by the value returned by the
769+
<code>localeconv</code> function (7.11.2.1).</td>
770+
<td>no</td>
771+
</tr>
772+
773+
<tr><td>
774+
&ndash; A macro definition of <code>math_errhandling</code> is suppressed or the program defines
775+
an identifier with the name <code>math_errhandling</code> (7.12).</td>
776+
<td>no</td>
777+
</tr>
778+
779+
<tr><td>
780+
&ndash; An argument to a floating-point classification or comparison macro is not of real
781+
floating type (7.12.3, 7.12.14).</td>
782+
<td>no</td>
783+
</tr>
784+
785+
<tr><td>
786+
&ndash; A macro definition of <code>setjmp</code> is suppressed in order to access an actual function, or
787+
the program defines an external identifier with the name <code>setjmp</code> (7.13).</td>
788+
<td>no</td>
789+
</tr>
790+
791+
<tr><td>
792+
&ndash; An invocation of the <code>setjmp</code> macro occurs other than in an allowed context
793+
(7.13.2.1).</td>
794+
<td>no</td>
795+
</tr>
796+
797+
<tr><td>
798+
&ndash; The <code>longjmp</code> function is invoked to restore a nonexistent environment (7.13.2.1).</td>
799+
<td>no</td>
800+
</tr>
801+
802+
<tr><td>
803+
&ndash; After a <code>longjmp</code>, there is an attempt to access the value of an object of automatic
804+
storage duration that does not have volatile-qualified type, local to the function
805+
containing the invocation of the corresponding <code>setjmp</code> macro, that was changed
806+
between the <code>setjmp</code> invocation and <code>longjmp</code> call (7.13.2.1).</td>
807+
<td>no</td>
808+
</tr>
809+
810+
<tr><td>
811+
&ndash; The program specifies an invalid pointer to a signal handler function (7.14.1.1).</td>
812+
<td>no</td>
813+
</tr>
814+
815+
<tr><td>
816+
&ndash; A signal handler returns when the signal corresponded to a computational exception
817+
(7.14.1.1).</td>
818+
<td>no</td>
819+
</tr>
820+
821+
<tr><td>
822+
&ndash; A signal handler called in response to <code>SIGFPE</code>,
823+
<code>SIGILL</code>, <code>SIGSEGV</code>, or any other
824+
implementation-defined value corresponding to a computational exception returns
825+
(7.14.1.1).</td>
826+
<td>no</td>
827+
</tr>
828+
829+
<tr><td>
830+
&ndash; A signal occurs as the result of calling the abort or raise function, and the signal
831+
handler calls the raise function (7.14.1.1).</td>
832+
<td>no</td>
833+
</tr>
834+
835+
<tr><td>
836+
&ndash; A signal occurs other than as the result of calling the abort or raise function, and
837+
the signal handler refers to an object with static or thread storage duration that is not a
838+
lock-free atomic object other than by assigning a value to an object declared as
839+
<code>volatile sig_atomic_t</code>, or calls any function in the standard library other
840+
than the <code>abort</code> function, the <code>_Exit</code> function, the
841+
<code>quick_exit</code> function, or the <code>signal</code> function (for the same
842+
signal number) (7.14.1.1).</td>
843+
<td>no</td>
844+
</tr>
845+
846+
<tr><td>
847+
&ndash; The value of <code>errno</code> is referred to after a signal occurred other than as the result of
848+
calling the abort or raise function and the corresponding signal handler obtained
849+
a <code>SIG_ERR</code> return from a call to the signal function (7.14.1.1).</td>
850+
<td>no</td>
851+
</tr>
852+
853+
<tr><td>
854+
&ndash; A signal is generated by an asynchronous signal handler (7.14.1.1).</td>
855+
<td>no</td>
856+
</tr>
857+
858+
<tr><td>
859+
&ndash; The signal function is used in a multi-threaded program (7.14.1.1).</td>
860+
<td>no</td>
861+
</tr>
862+
863+
<tr><td>
864+
&ndash; A function with a variable number of arguments attempts to access its varying
865+
arguments other than through a properly declared and initialized
866+
<code>va_list</code> object, or before the <code>va_start</code> macro is invoked
867+
(7.16, 7.16.1.1, 7.16.1.4).</td>
868+
<td>no</td>
869+
</tr>
870+
871+
<tr><td>
872+
&ndash; The macro <code>va_arg</code> is invoked using the parameter
873+
<code>ap</code> that was passed to a function
874+
that invoked the macro <code>va_arg</code> with the same parameter (7.16).</td>
875+
<td>no</td>
876+
</tr>
877+
878+
<tr><td>
879+
&ndash; A macro definition of <code>va_start</code>, <code>va_arg</code>,
880+
<code>va_copy</code>, or <code>va_end</code> is suppressed in
881+
order to access an actual function, or the program defines an external identifier with
882+
the name <code>va_copy</code> or <code>va_end</code> (7.16.1).</td>
883+
<td>no</td>
884+
</tr>
885+
886+
<tr><td>
887+
&ndash; The <code>va_start</code> or <code>va_copy</code> macro is invoked without a
888+
corresponding invocation of the <code>va_end</code> macro in the same function, or
889+
vice versa (7.16.1, 7.16.1.2, 7.16.1.3, 7.16.1.4).</td>
890+
<td>no</td>
891+
</tr>
892+
893+
<tr><td>
894+
&ndash; The type parameter to the <code>va_arg</code> macro is not such that a pointer
895+
to an object of that type can be obtained simply by postfixing a
896+
<code>*</code> (7.16.1.1).</td>
897+
<td>no</td>
898+
</tr>
899+
900+
<tr><td>
901+
&ndash; The <code>va_arg</code> macro is invoked when there is no actual next argument, or with a
902+
specified type that is not compatible with the promoted type of the actual next
903+
argument, with certain exceptions (7.16.1.1).</td>
904+
<td>no</td>
905+
</tr>
906+
907+
<tr><td>
908+
&ndash; The <code>va_copy</code> or <code>va_start</code> macro is called to initialize
909+
a <code>va_list</code> that was previously initialized by either macro without an
910+
intervening invocation of the <code>va_end</code> macro for the same
911+
<code>va_list</code> (7.16.1.2, 7.16.1.4).</td>
912+
<td>no</td>
913+
</tr>
914+
915+
<tr><td>
916+
&ndash; The parameter parmN of a <code>va_start</code> macro is declared with the register
917+
storage class, with a function or array type, or with a type that is not compatible with
918+
the type that results after application of the default argument promotions (7.16.1.4).</td>
919+
<td>no</td>
920+
</tr>
921+
922+
<tr><td>
923+
&ndash; The member designator parameter of an <code>offsetof</code> macro is an invalid right
924+
operand of the <code>.</code> operator for the type parameter, or designates a bit-field (7.19).</td>
925+
<td>no</td>
926+
</tr>
927+
928+
<tr><td>
929+
&ndash; The argument in an instance of one of the integer-constant macros is not a decimal,
930+
octal, or hexadecimal constant, or it has a value that exceeds the limits for the
931+
corresponding type (7.20.4).</td>
932+
<td>no</td>
933+
</tr>
934+
935+
<tr><td>
936+
&ndash; A byte input/output function is applied to a wide-oriented stream, or a wide character
937+
input/output function is applied to a byte-oriented stream (7.21.2).</td>
938+
<td>no</td>
939+
</tr>
940+
941+
<tr><td>
942+
&ndash; Use is made of any portion of a file beyond the most recent wide character written to
943+
a wide-oriented stream (7.21.2).</td>
944+
<td>no</td>
945+
</tr>
946+
947+
<tr><td>
948+
&ndash; The value of a pointer to a <code>FILE</code> object is used after the associated file is closed
949+
(7.21.3).</td>
950+
<td>no</td>
951+
</tr>
952+
953+
<tr><td>
954+
&ndash; The stream for the <code>fflush</code> function points to an input stream or to an update stream
955+
in which the most recent operation was input (7.21.5.2).</td>
956+
<td>no</td>
957+
</tr>
958+
959+
<tr><td>
960+
&ndash; The string pointed to by the mode argument in a call to the
961+
<code>fopen</code> function does not
962+
exactly match one of the specified character sequences (7.21.5.3).</td>
963+
<td>mo</td>
964+
</tr>
965+
966+
<tr><td>
967+
&ndash; An output operation on an update stream is followed by an input operation without an
968+
intervening call to the <code>fflush</code> function or a file positioning function, or an input
969+
operation on an update stream is followed by an output operation with an intervening
970+
call to a file positioning function (7.21.5.3).</td>
971+
<td>no</td>
972+
</tr>
973+
974+
<tr><td>
975+
&ndash; An attempt is made to use the contents of the array that was supplied in a call to the
976+
<code>setvbuf</code> function (7.21.5.6).</td>
977+
<td>no</td>
978+
</tr>
979+
980+
<tr><td>
981+
&ndash; There are insufficient arguments for the format in a call to one of the formatted
982+
input/output functions, or an argument does not have an appropriate type (7.21.6.1,
983+
7.21.6.2, 7.29.2.1, 7.29.2.2).</td>
984+
<td>no</td>
985+
</tr>
986+
987+
<tr><td>
988+
&ndash; The format in a call to one of the formatted input/output functions or to the
989+
<code>strftime</code> or <code>wcsftime</code> function is not a valid multibyte character sequence that
990+
begins and ends in its initial shift state (7.21.6.1, 7.21.6.2, 7.27.3.5, 7.29.2.1, 7.29.2.2,
991+
7.29.5.1).</td>
992+
<td>no</td>
993+
</tr>
994+
995+
<tr><td>
996+
&ndash; In a call to one of the formatted output functions, a precision appears with a
997+
conversion specifier other than those described (7.21.6.1, 7.29.2.1).</td>
998+
<td>no</td>
999+
</tr>
1000+
1001+
<tr><td>
1002+
&ndash; A conversion specification for a formatted output function uses an asterisk to denote
1003+
an argument-supplied field width or precision, but the corresponding argument is not
1004+
provided (7.21.6.1, 7.29.2.1).</td>
1005+
<td>no</td>
1006+
</tr>
1007+
1008+
<tr><td>
1009+
&ndash; A conversion specification for a formatted output function uses a
1010+
<code>#</code> or <code>0</code> flag with a
1011+
conversion specifier other than those described (7.21.6.1, 7.29.2.1).</td>
1012+
<td>no</td>
1013+
</tr>
1014+
1015+
<tr><td>
1016+
&ndash; A conversion specification for one of the formatted input/output functions uses a
1017+
length modifier with a conversion specifier other than those described (7.21.6.1,
1018+
7.21.6.2, 7.29.2.1, 7.29.2.2).</td>
1019+
<td>no</td>
1020+
</tr>
1021+
1022+
<tr><td>
1023+
&ndash; An s conversion specifier is encountered by one of the formatted output functions,
1024+
and the argument is missing the null terminator (unless a precision is specified that
1025+
does not require null termination) (7.21.6.1, 7.29.2.1).</td>
1026+
<td>no</td>
1027+
</tr>
1028+
1029+
<tr><td>
1030+
&ndash; An n conversion specification for one of the formatted input/output functions includes
1031+
any flags, an assignment-suppressing character, a field width, or a precision (7.21.6.1,
1032+
7.21.6.2, 7.29.2.1, 7.29.2.2).</td>
1033+
<td>no</td>
1034+
</tr>
1035+
1036+
<tr><td>
1037+
&ndash; A <code>%</code> conversion specifier is encountered by one of the formatted input/output
1038+
functions, but the complete conversion specification is not exactly %% (7.21.6.1,
1039+
7.21.6.2, 7.29.2.1, 7.29.2.2).</td>
1040+
<td>no</td>
1041+
</tr>
1042+
1043+
<tr><td>
1044+
&ndash; An invalid conversion specification is found in the format for one of the formatted
1045+
input/output functions, or the <code>strftime</code> or
1046+
<code>wcsftime</code> function (7.21.6.1, 7.21.6.2,
1047+
7.27.3.5, 7.29.2.1, 7.29.2.2, 7.29.5.1).</td>
1048+
<td>no</td>
1049+
</tr>
1050+
1051+
<tr><td>
1052+
&ndash; The number of characters or wide characters transmitted by a formatted output
1053+
function (or written to an array, or that would have been written to an array) is greater
1054+
than <code>INT_MAX</code> (7.21.6.1, 7.29.2.1).</td>
1055+
<td>no</td>
1056+
</tr>
1057+
1058+
<tr><td>
1059+
&ndash; The number of input items assigned by a formatted input function is greater than
1060+
<code>INT_MAX</code> (7.21.6.2, 7.29.2.2).</td>
1061+
<td>no</td>
1062+
</tr>
1063+
1064+
<tr><td>
1065+
&ndash; The result of a conversion by one of the formatted input functions cannot be
1066+
represented in the corresponding object, or the receiving object does not have an
1067+
appropriate type (7.21.6.2, 7.29.2.2).</td>
1068+
<td>no</td>
1069+
</tr>
1070+
1071+
<tr><td>
1072+
&ndash; A <code>c</code>, <code>s</code>, or <code>[</code> conversion specifier is
1073+
encountered by one of the formatted input functions, and the array pointed to by the
1074+
corresponding argument is not large enough to accept the input sequence (and a null
1075+
terminator if the conversion specifier is <code>s</code> or <code>[</code>)
1076+
(7.21.6.2, 7.29.2.2).</td>
1077+
<td>no</td>
1078+
</tr>
1079+
1080+
<tr><td>
1081+
&ndash; A <code>c</code>, <code>s</code>, or <code>[</code> conversion specifier with an
1082+
<code>l</code> qualifier is encountered by one of the
1083+
formatted input functions, but the input is not a valid multibyte character sequence
1084+
that begins in the initial shift state (7.21.6.2, 7.29.2.2).</td>
1085+
<td>no</td>
1086+
</tr>
1087+
1088+
<tr><td>
1089+
&ndash; The input item for a <code>%p</code> conversion by one of the formatted input
1090+
functions is not a value converted earlier during the same program execution
1091+
(7.21.6.2, 7.29.2.2).</td>
1092+
<td>no</td>
1093+
</tr>
1094+
1095+
<tr><td>
1096+
&ndash; The <code>vfprintf</code>, <code>vfscanf</code>,
1097+
<code>vprintf</code>, <code>vscanf</code>, <code>vsnprintf</code>,
1098+
<code>vsprintf</code>, <code>vsscanf</code>, <code>vfwprintf</code>,
1099+
<code>vfwscanf</code>, <code>vswprintf</code>, <code>vswscanf</code>,
1100+
<code>vwprintf</code>, or <code>vwscanf</code> function is called with an
1101+
improperly initialized <code>va_list</code> argument, or
1102+
the argument is used (other than in an invocation of <code>va_end</code>)
1103+
after the function returns (7.21.6.8, 7.21.6.9, 7.21.6.10, 7.21.6.11, 7.21.6.12, 7.21.6.13, 7.21.6.14,
1104+
7.29.2.5, 7.29.2.6, 7.29.2.7, 7.29.2.8, 7.29.2.9, 7.29.2.10).</td>
1105+
<td>no</td>
1106+
</tr>
1107+
1108+
<tr><td>
1109+
&ndash; The contents of the array supplied in a call to the
1110+
<code>fgets</code> or <code>fgetws</code> function are
1111+
used after a read error occurred (7.21.7.2, 7.29.3.2).</td>
1112+
<td>no</td>
1113+
</tr>
1114+
1115+
<tr><td>
1116+
&ndash; The file position indicator for a binary stream is used after a call to the
1117+
<code>ungetc</code> function where its value was zero before the call (7.21.7.10).</td>
1118+
<td>no</td>
1119+
</tr>
1120+
1121+
<tr><td>
1122+
&ndash; The file position indicator for a stream is used after an error occurred during a call to
1123+
the <code>fread</code> or <code>fwrite</code> function (7.21.8.1, 7.21.8.2).</td>
1124+
<td>no</td>
1125+
</tr>
1126+
1127+
<tr><td>
1128+
&ndash; A partial element read by a call to the <code>fread</code> function is used (7.21.8.1).</td>
1129+
<td>no</td>
1130+
</tr>
1131+
1132+
<tr><td>
1133+
&ndash; The <code>fseek</code> function is called for a text stream with a nonzero offset and either the
1134+
offset was not returned by a previous successful call to the
1135+
<code>ftell</code> function on a stream associated with the same file or whence is not
1136+
<code>SEEK_SET</code> (7.21.9.2).</td>
1137+
<td>no</td>
1138+
</tr>
1139+
1140+
<tr><td>
1141+
&ndash; The fsetpos function is called to set a position that was not returned by a previous
1142+
successful call to the <code>fgetpos</code> function on a stream associated with the same file
1143+
(7.21.9.3).</td>
1144+
<td>no</td>
1145+
</tr>
1146+
1147+
<tr><td>
1148+
&ndash; A non-null pointer returned by a call to the <code>calloc</code>,
1149+
<code>malloc</code>, or <code>realloc</code> function
1150+
with a zero requested size is used to access an object (7.22.3).</td>
1151+
<td>no</td>
1152+
</tr>
1153+
1154+
<tr><td>
1155+
&ndash; The value of a pointer that refers to space deallocated by a call to the
1156+
<code>free</code> or <code>realloc</code> function is used (7.22.3).</td>
1157+
<td>yes</td>
1158+
</tr>
1159+
1160+
<tr><td>
1161+
&ndash; The alignment requested of the <code>aligned_alloc</code> function is not valid or not
1162+
supported by the implementation, or the size requested is not an integral multiple of
1163+
the alignment (7.22.3.1).</td>
1164+
<td>no</td>
1165+
</tr>
1166+
1167+
<tr><td>
1168+
&ndash; The pointer argument to the <code>free</code> or
1169+
<code>realloc</code> function does not match a pointer
1170+
earlier returned by a memory management function, or the space has been deallocated
1171+
by a call to <code>free</code> or <code>realloc</code> (7.22.3.3, 7.22.3.5).</td>
1172+
<td>no</td>
1173+
</tr>
1174+
1175+
<tr><td>
1176+
&ndash; The value of the object allocated by the <code>malloc</code> function is used (7.22.3.4).</td>
1177+
<td>no</td>
1178+
</tr>
1179+
1180+
<tr><td>
1181+
&ndash; The value of any bytes in a new object allocated by the
1182+
<code>realloc</code> function beyond
1183+
the size of the old object are used (7.22.3.5).</td>
1184+
<td>no</td>
1185+
</tr>
1186+
1187+
<tr><td>
1188+
&ndash; The program calls the <code>exit</code> or <code>quick_exit</code> function more
1189+
than once, or calls both functions (7.22.4.4, 7.22.4.7).</td>
1190+
<td>no</td>
1191+
</tr>
1192+
1193+
<tr><td>
1194+
&ndash; During the call to a function registered with the
1195+
<code>atexit</code> or <code>at_quick_exit</code> function, a call is made to the
1196+
<code>longjmp</code> function that would terminate the call to the
1197+
registered function (7.22.4.4, 7.22.4.7).</td>
1198+
<td>no</td>
1199+
</tr>
1200+
1201+
<tr><td>
1202+
&ndash; The string set up by the <code>getenv</code> or
1203+
<code>strerror</code> function is modified by the program
1204+
(7.22.4.6, 7.24.6.2).</td>
1205+
<td>no</td>
1206+
</tr>
1207+
1208+
<tr><td>
1209+
&ndash; A signal is raised while the <code>quick_exit</code> function is executing (7.22.4.7).</td>
1210+
<td>no</td>
1211+
</tr>
1212+
1213+
<tr><td>
1214+
&ndash; A command is executed through the system function in a way that is documented as
1215+
causing termination or some other form of undefined behavior (7.22.4.8).</td>
1216+
<td>no</td>
1217+
</tr>
1218+
1219+
<tr><td>
1220+
&ndash; A searching or sorting utility function is called with an invalid pointer argument, even
1221+
if the number of elements is zero (7.22.5).</td>
1222+
<td>no</td>
1223+
</tr>
1224+
1225+
<tr><td>
1226+
&ndash; The comparison function called by a searching or sorting utility function alters the
1227+
contents of the array being searched or sorted, or returns ordering values
1228+
inconsistently (7.22.5).</td>
1229+
<td>no</td>
1230+
</tr>
1231+
1232+
<tr><td>
1233+
&ndash; The array being searched by the <code>bsearch</code> function does not have its
1234+
elements in proper order (7.22.5.1).</td>
1235+
<td>no</td>
1236+
</tr>
1237+
1238+
<tr><td>
1239+
&ndash; The current conversion state is used by a multibyte/wide character conversion
1240+
function after changing the <code>LC_CTYPE</code> category (7.22.7).</td>
1241+
<td>no</td>
1242+
</tr>
1243+
1244+
<tr><td>
1245+
&ndash; A string or wide string utility function is instructed to access an array beyond the end
1246+
of an object (7.24.1, 7.29.4).</td>
1247+
<td>yes</td>
1248+
</tr>
1249+
1250+
<tr><td>
1251+
&ndash; A string or wide string utility function is called with an invalid pointer argument, even
1252+
if the length is zero (7.24.1, 7.29.4).</td>
1253+
<td>yes</td>
1254+
</tr>
1255+
1256+
<tr><td>
1257+
&ndash; The contents of the destination array are used after a call to the
1258+
<code>strxfrm</code>, <code>strftime</code>, <code>wcsxfrm</code>, or
1259+
<code>wcsftime</code> function in which the specified length was
1260+
too small to hold the entire null-terminated result (7.24.4.5, 7.27.3.5, 7.29.4.4.4,
1261+
7.29.5.1).</td>
1262+
<td>no</td>
1263+
</tr>
1264+
1265+
<tr><td>
1266+
&ndash; The first argument in the very first call to the <code>strtok</code> or
1267+
<code>wcstok</code> is a null pointer (7.24.5.8, 7.29.4.5.7).</td>
1268+
<td>no</td>
1269+
</tr>
1270+
1271+
<tr><td>
1272+
&ndash; The type of an argument to a type-generic macro is not compatible with the type of
1273+
the corresponding parameter of the selected function (7.25).</td>
1274+
<td>no</td>
1275+
</tr>
1276+
1277+
<tr><td>
1278+
&ndash; A complex argument is supplied for a generic parameter of a type-generic macro that
1279+
has no corresponding complex function (7.25).</td>
1280+
<td>no</td>
1281+
</tr>
1282+
1283+
<tr><td>
1284+
&ndash; At least one member of the broken-down time passed to
1285+
<code>asctime</code> contains a value outside its normal range, or the calculated year
1286+
exceeds four digits or is less than the year 1000 (7.27.3.1).</td>
1287+
<td>no</td>
1288+
</tr>
1289+
1290+
<tr><td>
1291+
&ndash; The argument corresponding to an <code>s</code> specifier without an
1292+
<code>l</code> qualifier in a call to the <code>fwprintf</code> function does
1293+
not point to a valid multibyte character sequence that begins in the initial
1294+
shift state (7.29.2.11).</td>
1295+
<td>no</td>
1296+
</tr>
1297+
1298+
<tr><td>
1299+
&ndash; In a call to the <code>wcstok</code> function, the object pointed to by
1300+
<code>ptr</code> does not have the value stored by the previous call for the
1301+
same wide string (7.29.4.5.7).</td>
1302+
<td>no</td>
1303+
</tr>
1304+
1305+
<tr><td>
1306+
&ndash; An <code>mbstate_t</code> object is used inappropriately (7.29.6).</td>
1307+
<td>no</td>
1308+
</tr>
1309+
1310+
<tr><td>
1311+
&ndash; The value of an argument of type <code>wint_t</code> to a wide character
1312+
classification or case mapping function is neither equal to the value of
1313+
<code>WEOF</code> nor representable as a <code>wchar_t</code> (7.30.1).</td>
1314+
<td>no</td>
1315+
</tr>
1316+
1317+
<tr><td>
1318+
&ndash; The <code>iswctype</code> function is called using a different
1319+
<code>LC_CTYPE</code> category from the one in effect for the call to the
1320+
<code>wctype</code> function that returned the description (7.30.2.2.1).</td>
1321+
<td>no</td>
1322+
</tr>
1323+
1324+
<tr><td>
1325+
&ndash; The <code>towctrans</code> function is called using a different
1326+
<code>LC_CTYPE</code> category from the one in effect for the call to the
1327+
<code>wctrans</code> function that returned the description
1328+
(7.30.3.2.1).</td>
1329+
<td>no</td>
1330+
</tr>
1331+
1332+
</table>
1333+
1334+
</html>

0 commit comments

Comments
 (0)
Please sign in to comment.