The C standard identifies specific strings to use for the mode on calls to fopen() [ISO/IEC 9899:19992011]. To be strictly conforming and portable, one of the strings from the following table (adapted from the C standard) must be used:
...
An implementation may define additional mode strings, but only the modes shown in the table are fully portable and C99 C compliant [ISO/IEC 9899:19992011].
Risk Assessment
Using a mode string that is not recognized by an implementation may cause the call to fopen() to fail.
...
Tool | Version | Checker | Description | section||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Compass/ROSE |
|
| | Section |
| |||||||
| 590 S section | Partially Implementedimplemented |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...
CERT C++ Secure Coding Standard: FIO11-CPP. Take care when specifying the mode parameter of fopen()
ISO/IEC 9899:1999 Section 2011 Section 7.921.15.3, "The fopen function"
...