...
Non-Compliant Code Example
In this example, a file name is supplied to fopen() to create and open for writing. However, there is no guarantee that the file referenced by file_name does not exist prior to calling fopen(). This may cause an unintended file to be accessed or overwrittenan attempt is made to check whether a file exists before opening it for writing by trying to open the file for reading.
| Code Block |
|---|
|
...
FILE *fp fptr = fopen(file_name, "foo.txt","r");
if( !fp ) { /* file does not exist */
fopen("foo.txt","w");
if (!fptr) /* process file */
fclose(fp);
} else {
/* Handlefile Errorexists */
fclose(fp);
}
...
|
| Wiki Markup |
|---|
However, this code suffers from a _Time of Check, Time of Use_ (or _TOCTOU_) vulnerability (see \[[Seacord 05|AA. C++ References#Seacord 05]\] Section 7.2). On a shared multitasking system there is a window of opportunity between the first call of {{fopen()}} and the second call for a malicious attacker to, for example, create a link with the given filename to an existing file, so that the existing file is overwritten by the second call of {{fopen()}} and the subsequent writing to the file. |
Compliant Solution 1
| Wiki Markup |
|---|
The {{fopen()}} function does not indicate if an existing file has been opened for writing or a new file has been created. However, the {{open()}} function as defined in the Open Group Base Specifications Issue 6 \[[Open Group 04|AA. C References#Open Group 04]\] is available on many platforms and provides such a mechanism. If the {{O_CREAT}} and {{O_EXCL}} flags are used together, the {{open()}} function fails when the file specified by {{file_name}} already exists. |
...
