Page History

...

In this noncompliant example, the C standard library functions fprintffputs() and free() are called from the signal handler via the function log_message(). Neither function is asynchronous-safe.

...

The following table from the POSIX standard [IEEE Std 1003.1:2013] defines a set of functions that are asynchronous-signal-safe. Applications may invoke these functions, without restriction, from a signal handler.

`_Exit()`	`fexecve()`	`posix_trace_event()`	`sigprocmask()`
`_exit()`	`fork()`	`pselect()`	`sigqueue()`
`abort()`	`fstat()`	`pthread_kill()`	`sigset()`
`accept()`	`fstatat()`	`pthread_self()`	`sigsuspend()`
`access()`	`fsync()`	`pthread_sigmask()`	`sleep()`
`aio_error()`	`ftruncate()`	`raise()`	`sockatmark()`
`aio_return()`	`futimens()`	`read()`	`socket()`
`aio_suspend()`	`getegid()`	`readlink()`	`socketpair()`
`alarm()`	`geteuid()`	`readlinkat()`	`stat()`
`bind()`	`getgid()`	`recv()`	`symlink()`
`cfgetispeed()`	`getgroups()`	`recvfrom()`	`symlinkat()`
`cfgetospeed()`	`getpeername()`	`recvmsg()`	`tcdrain()`
`cfsetispeed()`	`getpgrp()`	`rename()`	`tcflow()`
`cfsetospeed()`	`getpid()`	`renameat()`	`tcflush()`
`chdir()`	`getppid()`	`rmdir()`	`tcgetattr()`
`chmod()`	`getsockname()`	`select()`	`tcgetpgrp()`
`chown()`	`getsockopt()`	`sem_post()`	`tcsendbreak()`
`clock_gettime()`	`getuid()`	`send()`	`tcsetattr()`
`close()`	`kill()`	`sendmsg()`	`tcsetpgrp()`
`connect()`	`link()`	`sendto()`	`time()`
`creat()`	`linkat()`	`setgid()`	`timer_getoverrun()`
`dup()`	`listen()`	`setpgid()`	`timer_gettime()`
`dup2()`	`lseek()`	`setsid()`	`timer_settime()`
`execl()`	`lstat()`	`setsockopt()`	`times()`
`execle()`	`mkdir()`	`setuid()`	`umask()`
`execv()`	`mkdirat()`	`shutdown()`	`uname()`
`execve()`	`mkfifo()`	`sigaction()`	`unlink()`
`faccessat()`	`mkfifoat()`	`sigaddset()`	`unlinkat()`
`fchdir()`	`mknod()`	`sigdelset()`	`utime()`
`fchmod()`	`mknodat()`	`sigemptyset()`	`utimensat()`
`fchmodat()`	`open()`	`sigfillset()`	`utimes()`
`fchown()`	`openat()`	`sigismember()`	`wait()`
`fchownat()`	`pause()`	`signal()`	`waitpid()`
`fcntl()`	`pipe()`	`sigpause()`	`write()`
`fdatasync()`	`poll()`	`sigpending()`

All functions not listed in this table are considered to be unsafe with respect to signals. In the presence of signals, all POSIX functions behave as defined when called from or interrupted by a signal handler, with a single exception: when a signal interrupts an unsafe function and the signal handler calls an unsafe function, the behavior is undefined.

...

This restriction does not apply to POSIX applications, as POSIX.1-2008 requires raise() to be async-signal-safe.

OpenBSD

The OpenBSD signal() manual page lists a few additional functions that are asynchronous-safe in OpenBSD but "probably not on other systems" [OpenBSD], including snprintf(), vsnprintf(), and syslog_r() but only when the syslog_data struct is initialized as a local variable.

...

Invoking functions that are not asynchronous-safe from within a signal handler is undefined behavior.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
SIG30-C	High	Likely	Medium	P18	L1

Automated Detection

Tool

Version

Checker

Description

Astrée

Include Page

	Astrée_V
	Astrée_V

signal-handler-unsafe-call

Partially checked

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-SIG30

Compass/ROSE

Can detect violations of the rule for single-file programs

LDRA tool suite

Include Page

	LDRA_V
	LDRA_V

88 D, 89 D

Partially implemented

Splint

Parasoft C/C++test

Include Page

Splint

	Parasoft_V

Splint_V

	Parasoft_V

CERT_C-SIG30-a

Properly define signal handlers

Polyspace Bug Finder

Include Page

	Polyspace Bug Finder_V
	Polyspace Bug Finder_V

CERT C: Rule SIG30-C

Checks for function called from signal handler not asynchronous-safe (rule fully covered)

PRQA QA-C

Include Page

	PRQA QA-C_v
	PRQA QA-C_v

2028, 2030

RuleChecker

Include Page

	RuleChecker_V
	RuleChecker_V

signal-handler-unsafe-call

Partially checked

Splint

Include Page

	Splint_V
	Splint_V

Related Vulnerabilities

For an overview of software vulnerabilities resulting from improper signal handling, see Michal Zalewski's paper "Delivering Signals for Fun and Profit" [Zalewski 2001].

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

Taxonomy	Taxonomy item	Relationship
ISO/IEC TS 17961:2013	Calling functions in the C Standard Library other than `abort`, `_Exit`, and `signal` from within a signal handler [asyncsig]

MITRE CWE

	Prior to 2018-01-12: CERT: Unspecified Relationship
CWE 2.11	CWE-479, Signal Handler Use of a Non-reentrant Function	2017-07-10: CERT: Exact

Bibliography

[C99 Rationale 2003]	Subclause 5.2.3, "Signals and Interrupts" Subclause 7.14.1.1, "The `signal` Function"
[Dowd 2006]	Chapter 13, "Synchronization and State"
[Greenman 1997]


[IEEE Std 1003.1:2013]	XSH, System Interfaces, `longjmp` XSH, System Interfaces, `raise`
[ISO/IEC 9899:2011]	7.14.1.1, "The `signal` Function"
[OpenBSD]	`signal()` Man Page
[VU #834865]


[Zalewski 2001]	"Delivering Signals for Fun and Profit"

...

Image Modified Image Modified Image Modified

adjust column widths

Space shortcuts

Page tree

Versions Compared

Old Version 140

New Version 155

Key

OpenBSD

Automated Detection

Related Vulnerabilities

Related Guidelines

Bibliography