Page History

Many functions return useful values whether or not the function has side effects. In most cases, this value is used to signify whether the function successfully completed its task or if some error occurred. (see See guideline ERR02-C. Avoid in-band error indicators.) . Other times, the value is the result of some computation and is an integral part of the function's API.

...

This recommendation encompasses guidelines MEM32-C. Detect and handle memory allocation errors, FIO04-C. Detect and handle input and output errors, and FIO34-C. Use int to capture the return value of character IO functions.

...

This compliant solution checks to make sure no output error occurred. (see See guideline FIO04-C. Detect and handle input and output errors.).

if (puts("foo") == EOF) {
  /* Handle error */
}

...

EXP12-EX1: If the return value is inconsequential or if any errors can be safely ignored, such as for functions called because of their side effects, the function should be explicitly cast to void to signify programmer intent. For an example of this exception, see the "compliant solution (Remove Existing Destination File)" under "Portable Behavior" section in guideline FIO10-C. Take care when using the rename() function.

...

Automated Detection

...

Tool	Version	Checker	Description
Section Coverity Prevent	Include Page c:Coverity_V c:Coverity_V	Section CHECKED_RETURN	Section finds inconsistencies in how function call return values are handled. Coverity Prevent cannot discover all violations of this recommendation, so further verification is necessary.
Section Splint	Include Page c:Splint_V

Splint Version 3.1.1 can detect violations of this recommendation.

Compass/ROSE can detect violations of this recommendation.

...

c:Splint_V
Section Compass/ROSE
Section Klocwork	Include Page c:Klocwork_V c:Klocwork_V	Section SV.RVT.RETVAL_NOTTESTED

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

Related Guidelines

This rule appears in the C++ Secure Coding Standard as : EXP12-CPP. Do not ignore values returned by functions or methods.

This rule appears in the Java Secure Coding Standard as : EXP00-J. Do not ignore values returned by methods.

Bibliography

\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 6.8.3, "Expression and null statements"
\[[ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] "CSJ Passing Parameters and Return Values"
\[[MITRE|AA. Bibliography#MITRE]\] [CWE ID 754|http://cwe.mitre.org/data/definitions/754.html], "Improper Check for Unusual or Exceptional Conditions"

...