Page History

Some C standard library functions are not guaranteed to be reentrant with respect to threads. Functions such as strtok() and asctime() return a pointer to the result stored in function-allocated memory on a per-process basis. Other functions such as rand() store state information in function-allocated memory on a per-process basis. Multiple threads invoking the same function can cause concurrency problems, which often result in abnormal behavior and can cause more serious vulnerabilities, such as abnormal termination, denial-of-service attack, and data integrity violations.

According to the C Standard, the library functions listed in the following table may contain data races when invoked by multiple threads.

...

...

Section 2.9.1 of the Portable Operating System Interface (POSIX^®), Base Specifications, Issue 7 [IEEE Std 1003.1:2013] extends the list of functions that are not required to be thread-safe.

...

In this noncompliant code example, the function f() is called from within a multithreaded application but encounters an error while calling a system function. The strerror() function returns a human-readable error string given an error number.

The C Standard, 7.2426.6.2 3 paragraph 3 [ISO/IEC 9899:20112024], specifically states that strerror() is not required to avoid data races.

The strerror function is not required to avoid data races with other calls to the strerror function.

An implementation could write the error string into a static array and return a pointer to it, and that array might be accessible and modifiable by other threads.

#include <errno.h>
#include <stdio.h>
#include <string.h>
 
void f(FILE *fp) {
  fpos_t pos;
  errno = 0;

  if (0 != fgetpos(fp, &pos)) {
    char *errmsg = strerror(errno);
    printf("Could not get the file position: %s\n", errmsg);
  }
}

Note that this This code first sets errno to 0 to comply with ERR30-C. Set errno to zero before calling a library function known to set errno, and check errno only after the function returns a value indicating failureTake care when reading errno. 

Compliant Solution (Annex K, strerror_s()) 

...

#define __STDC_WANT_LIB_EXT1__ 1
#include <errno.h>
#include <stdio.h>
#include <string.h>
 
enum { BUFFERSIZE = 64 };
void f(FILE *fp) {
  fpos_t pos;
  errno = 0;

  if (0 != fgetpos(fp, &pos)) {
    char errmsg[BUFFERSIZE];
    if (strerror_s(errmsg, BUFFERSIZE, errno) != 0) {
      /* Handle error */
    }
    printf("Could not get the file position: %s\n", errmsg);
  }
}

Note that because Because Annex K is optional, strerror_s() may not be available in all implementations. 

...

Race conditions caused by multiple threads invoking the same library function can lead to abnormal termination of the application, data integrity violations, or a denial-of-service attack.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Automated Detection

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-330 and CON33-C

Independent( MSC30-C, MSC32-C, CON33-C)

Intersection( CWE-330, CON33-C) =

• Use of rand() or srand() from multiple threads, introducing a race condition.

CWE-330 – CON33-C =

• Use of rand() or srand() without introducing race conditions

• Use of other dangerous functions

CON33-C – CWE-330 =

• Use of other global functions (besides rand() and srand()) introducing race conditions

CWE-377 and CON33-C

Intersection( CWE-377, CON33-C) =

• Use of tmpnam() from multiple threads, introducing a race condition.

CWE-377 – CON33-C =

• Insecure usage of tmpnam() without introducing race conditions

• Insecure usage of other functions for creating temporary files (see CERT recommendation FIO21-C for details)

CON33-C – CWE-377 =

• Use of other global functions (besides tmpnam()) introducing race conditions

CWE-676 and CON33-C

• Independent( ENV33-C, CON33-C, STR31-C, EXP33-C, MSC30-C, ERR34-C)

• CON33-C lists standard C library functions that manipulate global data (e.g., locale()), that can be dangerous to use in a multithreaded context.

• CWE-676 = Union( CON33-C, list) where list =

• Invocation of the following functions without introducing a race condition:

• rand(), srand(, getenv(), getenv_s(), strtok(), strerror(), asctime(), ctime(), localtime(), gmtime(), setlocale(), ATOMIC_VAR_INIT, atomic_init(), tmpnam(), mbrtoc16(), c16rtomb(), mbrtoc32(), c32rtomb()

• Invocation of other dangerous functions

Bibliography

...

...

Image Modified Image Modified Image Modified