...
Code Block | ||||
---|---|---|---|---|
| ||||
#include <csetjmp> #include <iostream> static jmp_buf env; struct Counter { static int Instances; Counter() { ++Instances; } ~Counter() { --Instances; } }; int Counter::Instances = 0; void f() { Counter c; std::cout << "f(): Instances: " << Counter::Instances << std::endl; std::longjmp(env, 1); } int main() { std::cout << "Before setjmp(): Instances: " << Counter::Instances << std::endl; if (setjmp(env) == 0) { f(); } else { std::cout << "From longjmp(): Instances: " << Counter::Instances << std::endl; } std::cout << "After longjmp(): Instances: " << Counter::Instances << std::endl; } |
Implementation Details
The above code produces the following results when compiled with Clang 3.5 for Linux, demonstrating that the undefined behavior in this instance is to fail to destroy the local Counter
instance when the execution of f()
is terminated:
...
Using setjmp()
and longjmp()
could lead to a denial-of-service attack due to resources not being properly destroyed.
...
Search for other vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
|
Bibliography
[ISO/IEC 14882-2014] | 18.10, "Other Runtime Support" |
[Henricson 97] | Rule 13.3, "Do not use setjmp() and longjmp() " |
...