CertC-EXP12

Do not ignore values returned by functions

Required inputs: IR

Many functions return useful values whether or not the function has side effects. In most cases, this value is used to signify whether the function successfully completed its task or if some error occurred (see ERR02-C. Avoid in-band error indicators). Other times, the value is the result of some computation and is an integral part of the function's API.

Subclause 6.8.3 of the C Standard [ ISO/IEC 9899:2011] states:

The expression in an expression statement is evaluated as a void expression for its side effects.

All expression statements, such as function calls with an ignored value, are implicitly cast to void. Because a return value often contains important information about possible errors, it should always be checked; otherwise, the cast should be made explicit to signify programmer intent. If a function returns no meaningful value, it should be declared with return type void.

This recommendation encompasses ERR33-C. Detect and handle standard library errors. Unlike this recommendation, that rule is restricted to functions from the Standard C library.

Compliance with this recommendation is required in order to comply with  ERR00-C. Adopt and implement a consistent and comprehensive error-handling policy

Noncompliant Code Example

This noncompliant code example calls fputs() and fails to check whether a write error occurs:

FILE* f = /* output file stream */
/* ... */
fputs("foo", f);

However, fputs() can fail and return EOF.

Compliant Solution

This compliant solution checks to make sure no output error occurred (see ERR33-C. Detect and handle standard library errors).

FILE* f = /* output file stream */
/* ... */
if (fputs("foo", f) == EOF) {
  /* Handle error */
}

Exceptions

EXP12-C-EX1: If the return value is inconsequential or if any errors can be safely ignored, such as for functions called because of their side effects, the function should be explicitly cast to void to signify programmer intent. For an example of this exception, see "Compliant Solution (Remove Existing Destination File)" under the section "Portable Behavior" in FIO10-C. Take care when using the rename() function, or Exception ERR33-C-EX1 in  ERR33-C. Detect and handle standard library errors.

EXP12-C-EX2: If a function cannot fail or if the return value cannot signify an error condition, the return value may be ignored. Such functions should be added to a whitelist when automatic checkers are used.

strcpy(dst, src);

Risk Assessment

Failure to handle error codes or other values returned by functions can lead to incorrect program flow and violations of data integrity.

Recommendation	Severity	Likelihood	Remediation Cost	Priority	Level
EXP12-C	Medium	Unlikely	Medium	P4	L3

Related Guidelines

SEI CERT C++ Coding Standard	VOID EXP12-CPP. Do not ignore values returned by functions or methods
CERT Oracle Secure Coding Standard for Java	EXP00-J. Do not ignore values returned by methods
ISO/IEC TR 24772:2013	Passing Parameters and Return Values [CSJ]
MITRE CWE	CWE-754, Improper check for unusual or exceptional conditions

Bibliography

[ ISO/IEC 9899:2011]

Subclause 6.8.3, "Expression and Null Statements"

Excerpt from SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition) and SEI CERT C Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-c-coding-standard/recommendations/expressions-exp/exp12-c], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
discarded_return	Return value of function discarded.	None	False

Options

• This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity

• The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

error_types

error_types : set[bauhaus.analysis.config.ShortTypeName] = set()

User defined error type names (if empty, all ignored int values are reported).

 

inspect_template_instances

inspect_template_instances : bool = False

Whether calls in template instances should be reported.

 

whitelist

whitelist

Type: dict[bauhaus.analysis.config.FileGlobPattern, list[bauhaus.analysis.config.GlobPattern]]

Default:

{
   'setjmp.h': ['setjmp', 'longjmp'],
   'signal.h': ['signal', 'raise'],
   'stdio.h': ['printf'],
   'string.h': ['str[!n]*'],
   'time.*': ['*']
}

Dictionary of header globbing to (list of) function names whose return codes can be ignored.