
...
If the signal occurs other than as the result of calling the abort or raise function, the behavior is undefined if the signal handler refers to any object with static or thread storage duration that is not a lock-free atomic object and that is not declared with the constexpr storage-class specifier other than by assigning a value to an object declared as volatile sig_atomic_t, or the signal handler calls any function in the standard library other than
— the abort function,
— the _Exit function,
— the quick_exit function,
— the functions in <stdatomic.h> (except where explicitly stated otherwise) when the atomic arguments are lock-free,
— the atomic_is_lock_free function with any atomic argument, or
— the signal function with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler. Furthermore, if such a call to the signal function results in a SIG_ERR return, the object designated by errno has an indeterminate representation.294)
...
Invoking the longjmp()
function from within a signal handler can lead to undefined behavior 132 if it results in the invocation of any non-asynchronous-safe functions. Consequently, neither longjmp()
nor the POSIX siglongjmp()
functions should ever be called from within a signal handler.
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
SIG30-C | High | Likely | Medium | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Astrée |
| signal-handler-unsafe-call | Partially checked | ||||||
Axivion Bauhaus Suite |
| CertC-SIG30 | |||||||
CodeSonar |
| BADFUNC.SIGNAL | Use of signal | ||||||
Compass/ROSE | Can detect violations of the rule for single-file programs | ||||||||
Cppcheck Premium |
| premium-cert-sig30-c | |||||||
Helix QAC |
| C2028, C2030 | |||||||
Klocwork |
| CERT.SIG.SIG_HANDLER.ASYNC_SAFE | |||||||
LDRA tool suite |
| 88 D, 89 D | Partially implemented | ||||||
Parasoft C/C++test |
| CERT_C-SIG30-a | Properly define signal handlers | ||||||
PC-lint Plus |
| 2670, 2761 | Fully supported | ||||||
| Checks for function called from signal handler not asynchronous-safe (rule fully covered) | ||||||||
RuleChecker |
| signal-handler-unsafe-call | Partially checked | ||||||
Splint |
|
...