Unreachable code facts for kids

Imagine a computer program as a set of instructions. Unreachable code is like a part of those instructions that the computer can never actually use or "reach." This happens because there's no path for the program to follow that leads to that specific code.

Sometimes, unreachable code is also called dead code. However, dead code can also mean code that does run but doesn't change anything important in the program's final result.

Unreachable code is usually not a good thing for a few reasons:

• It takes up space in the computer's memory for no reason.
• It can make the computer work harder than it needs to, even if it's not running the code.
• People might spend time testing, fixing, or writing notes about code that is never even used.

But sometimes, unreachable code can be useful. For example, a programmer might intentionally leave some code that can be used with a special tool called a debugger. A debugger helps programmers look inside a running program. If the program stops at a certain point (called a breakpoint), the programmer can use the unreachable code to check what's happening inside the program. This can be helpful when trying to fix problems in a program that's already being used by people.

Why Code Becomes Unreachable

Code can become unreachable for many reasons:

• Mistakes in programming: Sometimes, complex instructions can have errors that accidentally block off parts of the code.
• Compiler changes: A compiler is a program that turns human-written code into computer-readable code. Smart compilers (called optimizing compilers) sometimes change the code to make it run faster. These changes can accidentally make some parts unreachable.
• Not fully tested: New or changed code might not be tested enough, so no one realizes a part of it can't be reached.
• Old code: This is code that was once useful but is no longer needed.
  • It might have been replaced by newer, better code.
  • A programmer might not delete it because it's mixed in with code that is still used.
  • It might be code that could be reached, but current ways of using the program never need it.
  • It could be "sleeping" code kept on purpose in case it's needed later.
• Debugging code: Code used only for finding and fixing problems in a program.

Sometimes, code might be unreachable only under certain conditions. For example, a big library of code might have many features, but a specific program only uses a small part of them. The compiler might not be able to remove the unused parts because it doesn't know what will be needed until the program actually runs.

Examples of Unreachable Code

Let's look at some simple examples to understand this better.

Simple C Code Example

Here's a small piece of C programming code:

int foo (int X, int Y)
{
    return X + Y;
    int Z = X * Y;
}

In this example, the line `int Z = X * Y;` will never run. Why? Because the line `return X + Y;` tells the program to stop the function and give back the result of `X + Y` right away. The program never gets to the line about `Z`. So, `Z` doesn't need any memory space or setup.

The "goto fail" Bug

In February 2014, Apple had a big security problem in its SSL/TLS code, which helps keep internet connections safe. This problem was known as the "goto fail bug."

Look at this part of the code:

static OSStatus
SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams,
                                 uint8_t *signature, UInt16 signatureLen)
{
    OSStatus        err;
    ...
 
    if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
        goto fail;
        goto fail;
    if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
        goto fail;
    ...
 
fail:
    SSLFreeBuffer(&signedHashes);
    SSLFreeBuffer(&hashCtx);
    return err;
}

Notice the two lines that say `goto fail;` one after the other. In the C language, the second `goto fail;` line always runs. This means the program will always skip the important line `if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)`.

Because that important line is skipped, the program never properly checks the security signature. This meant that the security check would never fail, even if it should have! The part of the code that was supposed to do the final check became unreachable because of the extra `goto fail;` line.

Some special tools, like the Clang compiler with certain settings, can find this kind of unreachable code and warn programmers about it.

See also

In Spanish: Código inalcanzable para niños

• Code coverage
• Redundant code
• Dead code
• Oxbow code