CERT C: Rec. MSC19-C

R2026b

For functions that return an array, prefer returning an empty array over a null value

Since R2026b

Description

For functions that return an array, prefer returning an empty array over a null value¹

Polyspace Implementation

The rule checker checks for the issue Returning NULL instead of empty array.

Examples

Returning NULL instead of empty array

Issue

This issue occurs when a function returns:

• A direct array reference on one path and NULL on another path.

• A multi-element dynamically allocated buffer (via malloc, calloc, realloc, aligned_alloc, or alloca) on one path and NULL on another path.

The rule checker does not report a violation when:

• The allocation is a single element, such as malloc(sizeof(int)) or calloc(1, sizeof(int)), because these represent scalar values.

• The allocation is zero-size, such as calloc(0, sizeof(int)).

• The function returns char*, because returning NULL for strings is an intentional pattern.

Risk

If a function returns an array in some execution paths and NULL in others, callers must check whether the pointer is valid and whether the array contains data. This dual contract adds unnecessary complexity to your code. Callers that omit the NULL check can dereference a null pointer, causing a crash or undefined behavior. Returning a valid empty array instead simplifies the code so that callers only need to reason the array length.

Fix

Return the array directly instead of NULL. By always returning a valid pointer, callers can rely on the array length to determine whether data is present. Iterating over a zero-length array is a safe no-op, whereas iterating over a NULL pointer is undefined behavior.

Example — Returning NULL from a sensor data lookup

In this example, the function getReadings returns NULL when the sensor count is zero instead of returning the array directly. The downstream caller printFirstReading unconditionally dereferences the returned pointer, causing a null pointer dereference when count is zero. Polyspace^® reports a violation of this rule on the return NULL statement.

#include <stddef.h>
#include <stdio.h>

enum { MAX_SENSORS = 15 };

typedef struct {
    double readings[MAX_SENSORS];
    size_t count;
} SensorData;

double *getReadings(SensorData sd) {  /* Noncompliant */ 
    if (sd.count == 0) {
        return NULL;                  
    }
    return sd.readings;
}

void printFirstReading(SensorData sd) {
    double *values = getReadings(sd);
    printf("First reading: %f\n", values[0]);
}

Correction — Return the array directly

Return the array directly instead of NULL. Because the returned pointer is always valid, the caller only needs to check the array length to determine whether data is present. The caller can safely handle an empty array without risking a null pointer dereference.

#include <stddef.h>
#include <stdio.h>

enum { MAX_SENSORS = 15 };

typedef struct {
    double readings[MAX_SENSORS];
    size_t count;
} SensorData;

double *getReadings(SensorData sd) {
    return sd.readings;               /* Compliant */
}

void printFirstReading(SensorData sd) {
    double *values = getReadings(sd);
    if (sd.count > 0) {
        printf("First reading: %f\n", values[0]);
    }
}

Check Information

Group: Rec. 48. Miscellaneous (MSC)

PQL Name: std.cert.MSC19_C

Version History

Introduced in R2026b