...
In this non-compliant code example, main() invokes the malloc() function to allocated space to copy a string.
The string literal is copied into the allocated memory, which is then printed and the memory freed. The program also registers the signal handler int_handler()} to handle the terminal interrupt signal {{SIGINT.
Unfortunately, the free() function is not asynchronous-safe and its invocation from within a signal handler is a violation of this rule. If an interrupt signal is received during or after the free() call in main(), the heap may be corrupted.
| Code Block | ||
|---|---|---|
| ||
#include <signal.h>
char *foo;
void int_handler() {
free(foo);
_Exit(0);
}
int main(void) {
foo = malloc(sizeof("Hello World."));
if (foo == NULL) {
/* handle error condition */
}
signal(SIGINT, int_handler);
strcpy(foo, "Hello World.");
puts(foo);
free(foo);
return 0;
}
|
Note: The _Exit() function called from within the int_handler() signal handler causes immediate program termination, and is async-safe, whereas exit() may call cleanup routines first, and is therefore consequently not async-safe.
Compliant Solution
Signal handlers should be as minimal concise as possible, only ideally unconditionally setting a flag where appropriate, and returning. They may also call the _Exit() function.
| Code Block | ||
|---|---|---|
| ||
#include <signal.h>
char *foo;
void int_handler() {
_Exit(0);
}
int main(void) {
foo = malloc(15sizeof("Hello World."));
if(foo == NULL) {
/* handle error condition */
}
signal(SIGINT, int_handler);
strcpy(foo, "Hello World.");
puts(foo);
free(foo);
return 0;
}
|
Risk Assessment
| Wiki Markup |
|---|
DependingInvoking onfunctions thethat code,are thisnot couldasync-safe leadfrom towithin anya numbersignal ofhandler attacks,may manyresult ofin whichprivilege couldescalation giveand rootother accessattacks. For an overview of some software vulnerabilities, see Zalewski's paper on understanding, exploiting and preventing signal-handling related vulnerabilities \[[Zalewski 01|AA. C References#Zalewski 01]\]. [VU #834865|http://www.kb.cert.org/vuls/id/834865] describes a vulnerability resulting from a violation of this rule. |
...
| Wiki Markup |
|---|
\[[Dowd 06|AA. C References#Dowd 06]\] Chapter 13, "Synchronization and State" \[[ISO/IEC 03|AA. C References#ISO/IEC 03]\] Section 5.2.3, "Signals and Interrupts interrupts" \[[ISO/IEC 9899-1999:TC2|AA. C References#ISO/IEC 9899-1999TC2]\] Section 7.14, "Signal handling <signal.h>" \[[Open Group 04|AA. C References#Open Group 04]\] [longjmp|http://www.opengroup.org/onlinepubs/000095399/functions/longjmp.html] \[OpenBSD\] [{{signal()}} Man Page|http://www.openbsd.org/cgi-bin/man.cgi?query=signal] \[[Zalewski 01|AA. C References#Zalewski 01]\] |