My program uses the following define statements:

#define LOWEST_PATIENT_ID 10000
#define HIGHEST_PATIENT_ID 99999

used in this type of code:

   scanf("%d", &c_status);

I'm unclear about how this is more secure. or is it the typedef statement that is secure?

  • 3
    Who said it's for security?
    – user7043
    Feb 29 '12 at 16:19
  • Well I guess not then, @delnan. Someone mentioned that. Or was it typedef? Feb 29 '12 at 16:27

Indexes, limits, bounds, etc., are always security-related with C code because of overflow exploit issues. Specifically, if you get the number wrong, you code is a candidate for exploitation.

Assigning the constant to a symbol does two things: it makes the number easier to verify in a review because it's immediately obvious what the number means, and more importantly, it ensures that every time you use the number in your code, you're using the SAME value.

Imagine, for example, where the number represents the length of the input field, and at some point you increase that length to accommodate larger names. If you've specified the value numerically in your code, you have to go track down every instance of that number and replace it, but only if the instance of that number represents your specific field (you can't just use search and replace to change every instance of 128 to 256 because the number could mean different things).

Furthermore, in some instances you may be using N+1 (e.g. to allow for termination), so you'd have to track down every instance of 128 and every instance of 129. And was there a reason to specify 130 as well? Oh, now it's difficult to remember. But don't miss any of them of you'll create a classic buffer overflow exploit.

If instead you just did #define FIRST_NAME_LENGTH 128 in one of your include files, and keyed all the corresponding values off that, then you can just change the number once and be done with it.

This is true even in instances where you only use the number once, because while you're CURRENTLY only using the number once, someone may need to extend the code in the future.

This is such an important issue that you should have been taught from day 1 to avoid "magic numbers" in your code. If the number "means" something, then you should make its meaning explicit.


It doesn't.

#define statements in C aren't really useful for security. The use you put them to here is a means of improving readbility (and whether it does that is debateable) and of having what are, in effect, global variables in the file without having to worry about scoping.

  • I'm a little confused about the "worry about scoping" part. What do you mean ? Feb 29 '12 at 16:31
  • 1
    The values are constants, not variables, and they're certainly better than simply embedding magic numbers in your code.
    – TMN
    Feb 29 '12 at 17:21
  • Yes, I meant variable in terms of they can be easily changed at compile time to play with values.
    – TZHX
    Feb 29 '12 at 17:30
  • As opposed to actual variables.
    – TZHX
    Feb 29 '12 at 17:31

They can provide a degree of protection from buffer overflow-type attacks, since the range of the loop index is limited by a hard-coded value (presumably in a read-only area of memory) instead of being stored in a writable variable.


In this particular case, it's not about security so much as it is readability and maintainability.

LOWEST_CRITICAL_STATUS and HIGHEST_CRITICAL_STATUS convey more meaning than a literal 1 and 100 do. Also, if the value of either symbol needs to change, you only need to change it in one place, as opposed to hunting for every occurrence of a 1 or 100 in your source code (understanding that there may be some occurrences of 1 or 100 that shouldn't change).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.