use of Sys::SigAction::timeout_call unsafe?

Question

I've just read Leon Timmermans' article What you should know about signal based timeouts and I was wondering how it/if it applies to the use of Sys::SigAction::timeout_call().

1) First of all, it seems that timeout_call() uses longjmp and unsafe signals, and therefore CERT Secure Coding rule SIG32-C is applicable.

2) Is timeout_call safe to use if the code being monitored for timeouts only contains pure-perl code (i.e. no calls to XS modules)?

Answer 1

1) timeout_call() uses almost the exact same idiom to wrap a system call in an eval/alarm block as Leon's example:

my $ALARM_EXCEPTION = "alarm clock restart";
my $h;
eval {
    $h = set_sig_handler('ALRM', sub { die $ALARM_EXCEPTION }, { });
    alarm 10;
    flock $fh, 2 or die "cannot flock: $!";
    alarm 0;
};
alarm 0;
$SIG{ALRM} = $h;
if ($@ && $@ !~ quotemeta($ALARM_EXCEPTION)) { die }

So if set_sig_handler disables/overrides safe signal handling, then timeout_call will, too.

2) Pure Perl can still have plenty of interaction with the operating system, and how each system call responds to signals can vary widely between platforms. So in general the answer is no.