The UNREACH.RETURN checker looks for unreachable return statements in the code-any return that will never be used. A typical use for UNREACH.RETURN is to separate unreachable returns from other types of unreachable code. It is useful to be able to turn off the UNREACH.RETURN checker when you know there are unreachable returns in the code (particularly in generated code) that aren't significant, but still want to check for more generally unreachable code with UNREACH.GEN.

Vulnerability and risk

An unreachable return statement can cause confusion during code maintenance and/or code review. In some edge cases, an unreachable return can also cause unintended program behavior.

Vulnerable code example

1  void foo(int *p)
2  {
3      switch (*p) {
4          case 0:
5          case 1:
6              if (*p == 0) {
7                  ++(*p);
8                  return;
9              } else if (*p == 1){
10                 --(*p);
11                 return;
12             }
13             return;
14         default:
15             (*p) = 1 - (*p);
16     }
17 }

Klocwork produces a report of an unreachable void return statement, indicating that the return statement at line 13 is never reached. Obviously in this case, the behavior is benign and would typically cause the reviewer to turn this checker off (particularly if the pattern is one emitted by a code generator in a systematic manner).

Related checkers

External guidance

Extension

This checker can be extended. See Tuning C/C++ analysis for more information.