Use of deprecated signal() API instead of sigaction()
ID |
c.race_condition.insecure_api_signal |
Severity |
low |
Resource |
Race Condition |
Language |
C / C++ |
Description
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
Rationale
The signal() API should be regarded as deprecated. When possible, sigaction() should be used instead, because it allows to precisely specify the desired behavior in case two signals arrive shortly after each other thus preventing many race conditions.
The following code illustrates a vulnerable pattern detected by this rule:
int main(int argc, char *argv[])
{
logMessage = strdup(argv[1]);
// VULNERABLE: Use of deprecated signal() API instead of sigaction()
signal(SIGHUP, handler);
// VULNERABLE: Use of deprecated signal() API instead of sigaction()
signal(SIGTERM, handler);
sleep(10);
return 0;
}