...
The C Standard, 7.14.1.1, paragraph 5 [ISO/IEC 9899:20112024], states that if the signal occurs other than as the result of calling the abort() or raise() function, the behavior is undefined if if
...If the signal handler calls any function in the standard library occurs other than the
abortfunction, the_Exitfunction, thequick_exitfunction, or thesignalfunction with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler.as the result of calling the abort or raise function, the behavior is undefined if the signal handler refers to any object with static or thread storage duration that is not a lock-free atomic object and that is not declared with the constexpr storage-class specifier other than by assigning a value to an object declared as volatile sig_atomic_t, or the signal handler calls any function in the standard library other than— the abort function,
— the _Exit function,
— the quick_exit function,
— the functions in <stdatomic.h> (except where explicitly stated otherwise) when the atomic arguments are lock-free,
— the atomic_is_lock_free function with any atomic argument, or
— the signal function with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler. Furthermore, if such a call to the signal function results in a SIG_ERR return, the object designated by errno has an indeterminate representation.294)
Implementations may define a list of additional asynchronous-safe functions. These functions can also be called within a signal handler. This restriction applies to library functions as well as application-defined functions.
...
Invoking the longjmp() function from within a signal handler can lead to undefined behavior 132 if it results in the invocation of any non-asynchronous-safe functions. Consequently, neither longjmp() nor the POSIX siglongjmp() functions should ever be called from within a signal handler.
...
In this noncompliant code example, the int_handler() function is used to carry out tasks specific to SIGINT and then raises SIGTERM. However, there is a nested call to the raise() function, which is undefined behavior 131.
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <signal.h>
#include <stdlib.h>
void term_handler(int signum) {
/* SIGTERM handler */
}
void int_handler(int signum) {
/* SIGINT handler */
if (raise(SIGTERM) != 0) {
/* Handle error */
}
}
int main(void) {
if (signal(SIGTERM, term_handler) == SIG_ERR) {
/* Handle error */
}
if (signal(SIGINT, int_handler) == SIG_ERR) {
/* Handle error */
}
/* Program code */
if (raise(SIGINT) != 0) {
/* Handle error */
}
/* More code */
return EXIT_SUCCESS;
}
|
...
The C Standard, 7.14.1.1, paragraph 4 [ISO/IEC 9899:20112024], states
If the signal occurs as the result of calling the abort or raise function, the signal handler shall not call the raise function.
...
Invoking functions that are not asynchronous-safe from within a signal handler is undefined behavior 132.
Rule | Severity | Likelihood | Detectable | Remediation CostRepairable | Priority | Level |
|---|---|---|---|---|---|---|
SIG30-C | High | Likely | Yes | NoMedium | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| signal-handler-unsafe-call | Partially checked | ||||||||||
| Axivion Bauhaus Suite |
| CertC-SIG30 | |||||||||||
| CodeSonar |
| BADFUNC.SIGNAL | Use of signal | ||||||||||
| Compass/ROSE | Can detect violations | of the rule for single-file programsof the rule for single-file programs | |||||||||||
| Cppcheck Premium |
| premium-cert-sig30-c | |||||||||||
| Helix QAC |
| C2028, C2030 | |||||||||||
| Klocwork |
| CERT.SIG.SIG_HANDLER.ASYNC_SAFE | |||||||||||
| LDRA tool suite |
| 88 D, 89 D | Partially implemented | ||||||||||
| Parasoft C/C++test |
| CERT_C-SIG30-a | Properly define signal handlers | ||||||||||
| PC-lint Plus |
| 2670, 2761 | Fully supported | ||||||||||
| Checks for function called from signal handler not asynchronous-safe (rule fully covered) | PRQA QA-C | |||||||||||
| Include Page | PRQA QA-C_v | PRQA QA-C_v | |||||||||||
| 2028, 2030 | RuleChecker |
| signal-handler-unsafe-call | Partially checked | |||||||||
| Splint |
|
...
| [C99 Rationale 2003] | Subclause 5.2.3, "Signals and Interrupts" Subclause 7.14.1.1, "The signal Function" |
| [Dowd 2006] | Chapter 13, "Synchronization and State" |
| [Greenman 1997] | |
| [IEEE Std 1003.1:2013] | XSH, System Interfaces, longjmpXSH, System Interfaces, raise |
| [ISO/IEC 9899:20112024] | 7.14.1.1, "The signal Function" |
| [OpenBSD] | signal() Man Page |
| [VU #834865] | |
| [Zalewski 2001] | "Delivering Signals for Fun and Profit" |
...