Page History

...

The C Standard, 7.14.1.1, paragraph 5 [ISO/IEC 9899:20112024], states that if the signal occurs other than as the result of calling the abort() or raise() function, the behavior is undefined if if

...If the signal handler calls any function in the standard library occurs other than the abort function, the _Exit function, the quick_exit function, or the signal function with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler.as the result of calling the abort or raise function, the behavior is undefined if the signal handler refers to any object with static or thread storage duration that is not a lock-free atomic object and that is not declared with the constexpr storage-class specifier other than by assigning a value to an object declared as volatile sig_atomic_t, or the signal handler calls any function in the standard library other than

—  the abort function,

—  the _Exit function,

—  the quick_exit function,

—  the functions in <stdatomic.h> (except where explicitly stated otherwise) when the atomic arguments are lock-free,

—  the atomic_is_lock_free function with any atomic argument, or

—  the signal function with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler. Furthermore, if such a call to the signal function results in a SIG_ERR return, the object designated by errno has an indeterminate representation.294)

Implementations may define a list of additional asynchronous-safe functions. These functions can also be called within a signal handler. This restriction applies to library functions as well as application-defined functions.

...

Invoking the longjmp() function from within a signal handler can lead to undefined behavior 132 if it results in the invocation of any non-asynchronous-safe functions. Consequently, neither longjmp() nor the POSIX siglongjmp() functions should ever be called from within a signal handler.

...

In this noncompliant code example, the int_handler() function is used to carry out tasks specific to SIGINT and then raises SIGTERM. However, there is a nested call to the raise() function, which is undefined behavior 131.

#include <signal.h>
#include <stdlib.h>
 
void term_handler(int signum) {
  /* SIGTERM handler */
}
 
void int_handler(int signum) {
  /* SIGINT handler */
  if (raise(SIGTERM) != 0) {
    /* Handle error */
  }
}
 
int main(void) {
  if (signal(SIGTERM, term_handler) == SIG_ERR) {
    /* Handle error */
  }
  if (signal(SIGINT, int_handler) == SIG_ERR) {
    /* Handle error */
  }
 
  /* Program code */
  if (raise(SIGINT) != 0) {
    /* Handle error */
  }
  /* More code */
 
  return EXIT_SUCCESS;
}

...

The C Standard, 7.14.1.1, paragraph 4 [ISO/IEC 9899:20112024], states

If the signal occurs as the result of calling the abort or raise function, the signal handler shall not call the raise function.

...

Invoking functions that are not asynchronous-safe from within a signal handler is undefined behavior.

...

Rule

...

Severity

...

Likelihood

...

Remediation Cost

...

Priority

...

Level

...

SIG30-C

...

High

...

Likely

...

Medium

...

P18

...

L1

is undefined behavior 132.

Automated Detection

Automated Detection

Related Vulnerabilities

For an overview of software vulnerabilities resulting from improper signal handling, see Michal Zalewski's paper "Delivering Signals for Fun and Profit" [Zalewski 2001].

...

...