Page History

The C99 C Standard provides three functions that cause an application to terminate normally: _Exit(), exit(), and quick_exit(). These are collectively called exit functions. When the exit() function is called, or control transfers out of the main() entry point function, functions registered with atexit() are called (but not at_quick_exit()). When the quick_exit() function is used for normal program termination. If more than one call to exit() is executed by a program, the behavior is undefined. This may occur when functions are registered with atexit(), a function that causes the functions registered to it to be called with when the program exits. If a function called as a result of being registered with atexit() has an exit() call in it there is undefined behavior.

Non-Compliant Code Example

In this example the function exit1() is registered by atexit() so upon program termination exit1() is called and certain cleanup and maintenance functions can occur. If some failure case <expr> evaluates as true though the program attempts to fully exit before the cleanup code can be processed. In these cases where expr evaluates to true exit() will be called twice and the behavior is undefined. Some compilers will simply ignore the exit() call as it in is a function registered by atexit().

called, functions registered with at_quick_exit() (but not atexit()) are called. These functions are collectively called exit handlers.  When the _Exit() function is called, no exit handlers or signal handlers are called.

Exit handlers must terminate by returning. It is important and potentially safety-critical for all exit handlers to be allowed to perform their cleanup actions. This is particularly true because the application programmer does not always know about handlers that may have been installed by support libraries. Two specific issues include nested calls to an exit function and terminating a call to an exit handler by invoking longjmp.

A nested call to an exit function is undefined behavior. (See undefined behavior 182.) This behavior can occur only when an exit function is invoked from an exit handler or when an exit function is called from within a signal handler. (See SIG30-C. Call only asynchronous-safe functions within signal handlers.)

If a call to the longjmp() function is made that would terminate the call to a function registered with atexit(), the behavior is undefined.

Noncompliant Code Example

In this noncompliant code example, the exit1() and exit2() functions are registered by atexit() to perform required cleanup upon program termination. However, if some_condition evaluates to true, exit() is called a second time, resulting in undefined behavior.

#include <stdlib.h>

void exit1(void) {
  /* ... Cleanup code ... */
  return;
}
 
void exit2(void) {
  extern int some_condition;
  if (some_condition) {
    /* ... More cleanup code ... */
    exit(0);
  }
  return;
}

int main(void) {
  if (atexit(exit1) != 0) {
    /* Handle error */
  }
  if (atexit(exit2) != 0) {
    /* Handle error */
  }
  /* ... Program code ... */
  return 0;
}

Functions registered by the atexit() function are called in the reverse order from which they were registered. Consequently, if exit2() exits in any way other than by returning, exit1() will not be executed. The same may also be true for atexit() handlers installed by support libraries.

Compliant Solution

A function that is registered as an exit handler by atexit() must exit by returning, as in this compliant solution:

#include <stdlib.h>

void exit1(void) {
  /* ... Cleanup code ... */
  return;
}
 
void exit2(void) {
  extern int some_condition;
  if (some_condition) {
    /* ... More cleanup code ... */
  }
  return;
}

int main(void) {
  if (atexit(exit1) != 0) {
    /* Handle error */
  }
  if (atexit(exit2) != 0) {
    /* Handle error */
  }
  /* ... Program code ... */
  

#include <stdio.h>
#include <stdlib.h>


void exit1(void) {
if(expr)
       exit();
       //clean up and ready program for closing
           ...
}

int main (void) {

    atexit(exit1);
    ...
     //program code
     return 0;
}

...

Noncompliant Code

...

To have functionality where the program can quit from within a function registered by at_exit() it is necessary to use a function used for abnormal termination such as _Exit() or abort().

_Exit() a c99 defined function is described as follows: 

The function _exit terminates the calling process "immediately". Any open file descriptors belonging to the process are closed; any children of the process are inherited by process 1, init, and the process's parent is sent a SIGCHLD signal. The value status is returned to the parent process as the process's exit status, and can be collected using one of the wait family of calls. The function _Exit is equivalent to _exit.

Example

In this noncompliant code example, exit1() is registered by atexit() so that upon program termination, exit1() is called. The exit1() function jumps back to main() to return, with undefined results.

#include <stdlib.h>
#include <setjmp.h>

jmp_buf env;
int val;

#include <stdio.h>
#include <stdlib.h>

#include <stdio.h>
#include <stdlib.h>

void exit1(void) {
if(expr)
       _Exit();  longjmp(env, 1);
}

int main(void) {
  if (atexit(exit1) != 0) {
    /* Handle error //clean up and ready program for closing
           ...*/
  }
  if (setjmp(env) == 0) {
    exit(0);
  } else {
    return 0;
  }
}

Compliant Solution

This compliant solution does not call longjmp()but instead returns from the exit handler normally:

#include <stdlib.h>

void exit1(void) {
  return;
}

int main (void) {

  if  (atexit(exit1);
    ...
     //program code
      != 0) {
    /* Handle error */
  }
  return 0;
}

The call to _Exit() will immediately terminate the program and no undefined behavior will happen like in the non compliant example.

Risk Assessment

Multiple calls Terminating a call to an exit in code are likely to be rare but if exist can cause denial of service and abnormal program termination.handler in any way other than by returning is undefined behavior and may result in abnormal program termination or other unpredictable behavior. It may also prevent other registered handlers from being invoked.

References

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-705 and ENV32-C

CWE-705 = Union( ENV32-C, list) where list =

• Improper control flow besides a non-returning exit handler

...

Image Added Image Added Image Added Wiki Markup\[[ISO/IEC 9899-1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.20.4.3, "The exit function"