Page History

...

• do not need to set errno on an error.
• have undefined behavior if the value of the result cannot be represented. (See undefined behavior 113 of Annex J of C99.)
• return 0 if the string does not represent an integer (which is indistinguishable from a correctly formatted, zero-denoting input string), but C99 only specifies the behavior of these functions on success.

See also rule MSC34-C. Do not use deprecated or obsolescent obsolete functions.

Compliant Solution (strtol())

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

ISO/IEC 9899:1999 Section 7.20.1.4, "The strtol, strtoll, strtoul, and strtoull functions," Section 7.20.1.2, "The atoi, atol, and atoll functions," Section 7.19.6.7, "The sscanf function," Section 7.19.5.5, "The setbuf function", Section 7.19.9.2, "The fseek function"; 7.19.9.5, and "The rewind function"

...

MITRE CWE: CWE-20, "Insufficient Input Validation"

Bibliography

[Klein 2002]

...

Image RemovedERR06-C. Understand the termination behavior of assert() and abort()      12. Error Handling (ERR)      ERR31-C. Don't redefine errno