Ventura/Sonoma Silicon no signal when null dereference

Ventura 13.2.1 M1 Sonoma 14.2.1 M2

In my app I have a signal handler.
When testing it with null-dereference I see that in previous MacOs versions like Monterey 12.0 x86 the signal handler is called.
However, on my Silicon Ventura/Sonoma machines its not called.
Tried with SIP enabled and disabled

So I created a binary with code:

#include <iostream>

int main() {
    int *ptr = nullptr; 
    std::cout << *ptr; // Dereference null pointer
    return 0;
}

Compiled it with:

g++ null.cpp -o null.bin

And executed it with and without sudo.

The app indeed crashes because of the null dereference (and core dump is created when SIP disabled).
However, no signal is recived. I am able to prove it with DTrace .
DTrace script:

#pragma D option quiet

proc:::signal-send
{
    @[execname, stringof(args[1]->pr_fname), args[2]] = count();
}

END
{
    printf("%20s %20s %12s %s\n",
        "SENDER", "RECIPIENT", "SIG", "COUNT");
    printa("%20s %20s %12d %@d\n", @);
}

Here is the output. In the left terminal I executed the binary. In the right terminal the script output.

On top of DTrace I created and MacOS endpoint-security app and subscribed to ES_EVENT_TYPE_NOTIFY_SIGNAL. Same there, no signal.

Did anything change with signals on M1/M2 MacOS 13.0 ?

Replies

This is one of those ‘if a tree falls in a forest’ questions. If an app crashes in a way that could be caught by a signal handler and there’s no signal handler, was a signal really delivered?

Why are you trying to monitor signal delivery? For an ES client?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • @eskimo 1 - I am testing my signal handler and my tests fail. Starting to investigate, I saw that no signal is sent. 2 - I don't agree with the ‘if a tree falls in a forest’ comperison for a few reasons. I use external tools like DTrace and EndpointSecurity to validate that there is no signal. And I do have a signal handler, so if there isn't a bug (or new behavior in the OS) the signal handler is suppose to be called. Like its called in my x86 machines.

Add a Comment