Page History

Some errors, such as out-of-range values, might be the result of erroneous user input. Interactive programs typically handle such errors by rejecting the input and prompting the user for an acceptable value. Servers reject invalid user input by indicating an error to the client while at the same time continuing to service other clients' valid requests. All robust programs must be prepared to gracefully handle resource exhaustion, such as low memory or disk space conditions, at a minimum by preventing the loss of user data kept in volatile storage. Interactive programs may give the user the option to save data on an alternative medium, whereas network servers may respond by reducing throughput or otherwise degrading the quality of service. However, when certain kinds of errors are detected, such as irrecoverable logic errors, rather than risk data corruption by continuing to execute in an indeterminate state, the appropriate strategy may be for the system to quickly shut down, allowing the operator to start it afresh in a determinate state.

ISO/IEC TR 24772:2013, Section 6.39, "Termination Strategy [REU]," [ISO/IEC TR 24772:2013], says:

When a fault is detected, there are many ways in which a system can react. The quickest and most noticeable way is to fail hard, also known as fail fast or fail stop. The reaction to a detected fault is to immediately halt the system. Alternatively, the reaction to a detected fault could be to fail soft. The system would keep working with the faults present, but the performance of the system would be degraded. Systems used in a high availability environment such as telephone switching centers, e-commerce, or other "always available" applications would likely use a fail soft approach. What is actually done in a fail soft approach can vary depending on whether the system is used for safety-critical or security critical purposes. For fail-safe systems, such as flight controllers, traffic signals, or medical monitoring systems, there would be no effort to meet normal operational requirements, but rather to limit the damage or danger caused by the fault. A system that fails securely, such as cryptologic systems, would maintain maximum security when a fault is detected, possibly through a denial of service.

...

Calling exit() causes normal program termination to occur. Other than returning from main(), calling exit() is the typical way to end a program. The function takes one argument of type int, which should be either EXIT_SUCCESS or EXIT_FAILURE, indicating successful or unsuccessful termination respectively. The value of EXIT_SUCCESS is guaranteed to be 0. The C Standard,  Section subclause 7.22.4.4 [ISO/IEC 9899:2011], says, "If the value of status is zero or EXIT_SUCCESS, an implementation-defined form of the status successful termination is returned." The exit() function never returns.

#include <stdlib.h>
/* ... */

if (/* somethingSomething really bad happened */) {
  exit(EXIT_FAILURE);
}

...

Note that the behavior of a program that calls exit() from an atexit handler is undefined. (See undefined behavior 182 in Annex J of the C Standard. See also ENV32-C. All atexit exit handlers must return normally.)

return from main()

Returning from main() causes normal program termination to occur, which is the preferred way to terminate a program. Evaluating the return statement has the same effect as calling exit() with the same argument.

#include <stdlib.h>
 
int main(int argc, char **argv) {
  /* ... */
  if (/* somethingSomething really bad happened */) {
    return EXIT_FAILURE;
  }
  /* ... */
  return EXIT_SUCCESS;
}

The C Standard, Section subclause 5.1.2.2.3 [ISO/IEC 9899:2011], has this to say about returning from main():

...

#include <stdlib.h>
/* ... */

if (/* somethingSomething really bad happened */) {
  _Exit(EXIT_FAILURE);
}

...

Calling abort() causes abnormal program termination to occur unless the SIGABRT signal is caught and the signal handler calls exit() or _Exit().:

#include <stdlib.h>
/* ... */

if (/* somethingSomething really bad happened */) {
  abort();
}

...

Summary

The following table summarizes the exit behavior of the program termination functions.

Table legend:

• – Yes. The specified action is performed.
• – No. The specified action is not performed.
• – Implementation-defined. Whether the specified action is performed depends on the implementation.

...

#include <stdlib.h>
#include <stdio.h>

int write_data(void) {
  const char *filename = "hello.txt";
  FILE *f = fopen(filename, "w");
  if (f == NULL) {
    /* Handle error */
  }
  fprintf(f, "Hello, World\n");
  /* ... */
  abort(); /* Oops! Data might not be written! */
  /* ... */
  return 0;
}

int main(void) {
  write_data();
  return 0EXIT_SUCCESS;
}

Compliant Solution

In this compliant solution, the call to abort() is replaced with exit(), which guarantees that buffered I/O data is flushed to the file descriptor and the file descriptor is properly closed.:

#include <stdlib.h>
#include <stdio.h>

int write_data(void) {
  const char *filename = "hello.txt";
  FILE *f = fopen(filename, "w");
  if (f == NULL) {
    /* Handle error */
  }
  fprintf(f, "Hello, World\n");
  /* ... */
  exit(EXIT_FAILURE); /* Writes data and closes f. */
  /* ... */
  return 0;
}

int main(void) {
  write_data();
  return 0EXIT_SUCCESS;
}

Although this particular example benefits from calling exit() over abort(), in some situations, abort() is the better choice. Usually, abort() is preferable when a programmer does not need to close any file descriptors or call any handlers registered with atexit(), for instance, if the speed of terminating the program is critical.

...

As an example, using abort() or _Exit() in place of exit() may leave written files in an inconsistent state and may also leave sensitive temporary files on the file system.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

Image Modified Image Modified Image Modified