ERR04-A. Understand the differences between exit(), _exit(), and abort()

Some errors, such as a value out of range, might be the result of erroneous user input. If the input is interactive, the program can just prod the user for a more acceptable value. With other errors, such as a resource allocation failure, the system may have little choice other than to shutdown.

exit()

This is the standard C function to end a program. It takes one argument, which should be either EXIT_SUCCESS or EXIT_FAILURE indicating normal or abnormal termination. It never returns.

#include <stdlib.h>
/* ... */

if (/* something really bad happened */) {
  exit(EXIT_FAILURE); 
}

Calling exit()

• Flushes unwritten buffered data.
• Closes all open files.
• Removes temporary files.
• Returns an integer exit status to the operating system.

_exit()

A less polite function, _exit() also takes one argument and never returns. The standard specifies that _exit() also closes open file descriptors, but does not specify if _exit() flushes file buffers or deletes temporary files.

#include <stdlib.h>
/* ... */

if (/* something really bad happened */) {
  _exit(EXIT_FAILURE); 
}

The _Exit() function is a synonym for _exit()

abort()

The quickest way to terminate a program, abort() takes no parameter, and always signifies abnormal termination to the operating system.

#include <stdlib.h>
/* ... */

if (/* something really bad happened */) {
  abort(); 
}

The abort() function causes abnormal program termination to occur, unless the signal SIGABRT is being caught and the signal handler does not return.

Whether open streams with unwritten buffered data are flushed, open streams are closed, or temporary files are removed is implementation-defined.

Summary

atexit()

You can use the Standard C atexit() function to customize exit() to perform additional actions at program termination.

For example, calling:

  atexit(turn_gizmo_off); 

"registers" the turn_gizmo_off() function so that a subsequent call to exit() will invoke turn_gizmo_off(); as it terminates the program. The C standard says that atexit() should let you register up to 32 functions.

atexit() is only called by exit() or upon normal completion of main(). It is not called by _exit() or abort().

Non-Compliant Code Example

In this example, abort() is called after data is sent to an open file descriptor. The data may or may not actually get written to the file.

#include <stdlib.h>
#include <stdio.h>

int write_data() {
  const char* filename = "hello.txt";
  FILE *f = fopen(filename, "w");
  if (f == NULL) {
    /* handle error */
  }
  fprintf(f, "Hello, World\n");
  /* ... */
  abort(); /* oops! data might not get written! */
  /* ... */
  return 0;
}

int main() {
  write_data();
  return 0;
}

Compliant Solution

In this solution, the call to abort() is replaced with exit(), which guarantees that buffered I/O data is flushed to the file descriptor and the file descriptor is properly closed.

#include <stdlib.h>
#include <stdio.h>

int write_data() {
  const char* filename = "hello.txt";
  FILE *f = fopen(filename, "w");
  if (f == NULL) {
    /* handle error */
  }
  fprintf(f, "Hello, World\n");
  /* ... */
  exit(EXIT_FAILURE); /* writes data & closes f. */
  /* ... */
  return 0;
}

int main() {
  write_data();
  return 0;
}

Risk Analysis

An usage of abort() or _exit() in place of exit() may leave files written in an inconsistent state. It may also leave sensitive temporary files on the filesystem.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

ERR03-A. Use runtime-constraint handlers when calling functions defined by TR24731-1      13. Error Handling (ERR)       ERR03-A. Use runtime-constraint handlers when calling functions defined by TR24731-1