Page History

...

A return type of errno_t indicates that the function returns a status indicator . (See see DCL09-C. Declare functions that return errno with a return type of errno_t).)

This error-handling approach is secure, but it has the following drawbacks:

Source and object code can significantly increase in size, perhaps by as much as 30 to 40 percent [Saks 2007b].
All function return values must be checked . (See void MEM32see ERR33-C. Detect and handle memory allocation standard library errors).)
Functions should not return other values if they return error indicators . (See see ERR02-C. Avoid in-band error indicators).)
Any function that allocates resources must ensure they are freed in cases where errors occur.

...

The following table summarizes the characteristics of error-reporting and error-detection mechanisms.

Method	Code Increase	Manages Allocated Resources	Automatically Enforceable
Return value	Big (30–40%)	No	Yes
Address argument	Bigger	No	No
Global indicator	Medium	No	Yes
`longjmp()`	Small	No	n/a

Risk Assessment

Lack of an error-detection mechanism prevents applications from knowing when an error has disrupted normal program behavior.

Recommendation	Severity	Likelihood	Remediation Cost	Priority	Level
ERR05-C	Medium	Probable	High	P4	L3

Automated Detection

Tool	Version	Checker	Description
Compass/ROSE

Could detect violations of this rule merely by reporting functions that call abort(), exit(), or _Exit() inside an if or switch statement.
This would also catch many false positives, as ROSE could not distinguish a library function from an application function

Parasoft C/C++test

Include Page

	Parasoft_V
	Parasoft_V

CERT_C-ERR05-a
CERT_C-ERR05-b
CERT_C-ERR05-c

The 'abort()' function from the 'stdlib.h' or 'cstdlib' library shall not be used
The 'exit()' function from the 'stdlib.h' or 'cstdlib' library shall not be used
The 'quick_exit()' and '_Exit()' functions from the 'stdlib.h' or 'cstdlib' library shall not be u