...
The type sig_atomic_t is the integer type of an object that can be accessed as an atomic entity, even in the presence of asynchronous interrupts. The type of sig_atomic_t is implementation-defined, though it provides some guarantees. Integer values ranging from SIG_ATOMIC_MIN through SIG_ATOMIC_MAX, inclusive, may be safely stored to a variable of the type. In addition, when sig_atomic_t is a signed integer type, SIG_ATOMIC_MIN must be no greater than -127 and SIG_ATOMIC_MAX no less than 127. Otherwise, SIG_ATOMIC_MIN must be 0 and SIG_ATOMIC_MAX must be no less than 255. The macros SIG_ATOMIC_MIN and SIG_ATOMIC_MAX are defined in the header <stdint.h>.
According to the C99 Rationale [ISO/IEC 2003], other than calling a limited, prescribed set of library functions,
the C89 Committee concluded that about the only thing a strictly conforming program can do in a signal handler is to assign a value to a
volatile staticvariable which can be written uninterruptedly and promptly return.
...
The signal handler may also call a handful of functions, including abort(). (See SIG30-C. Call only asynchronous-safe functions within signal handlers for details of functions that can be safely called from within signal handlers.)
...
Accessing or modifying shared objects in signal handlers can result in accessing data in an inconsistent state. Zalewski's paper "Delivering Signals for Fun and Profit" provides some examples of vulnerabilities that can result from violating this and other signal-handling rules [Zalewski 2001].
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SIG31-C | high | likely | high | P9 | L2 |
...
CERT C++ Secure Coding Standard: SIG31-CPP. Do not access or modify shared objects in signal handlers
...
MITRE CWE: CWE ID 662, "Insufficient synchronization"
Bibliography
[Dowd 2006] Chapter 13, Synchronization and State
[ISO/IEC 2003] "Signals and interrupts"
[Open Group 2004] longjmp
[OpenBSD] signal() Man Page
[Zalewski 2001]
...