Page History

Do not use deprecated or obsolescent functions when more secure equivalent functions are available.
Deprecated functions are defined by the C99 standard and Technical Corrigenda. Obsolescent functions C Standard. Obsolete functions are typically functions for which there are more secure or portable alternatives available and are defined by this guidelinerule.

Deprecated Functions

The gets function was deprecated by in Technical Corrigendum 3 of the C99 standard and eliminated from the C11 standard.

Obsolescent Functions

The following functions are obsolescent obsolete and should be avoided in favor of either the portable equivalent or, if available, the more secure alternatives defined in [ISO/IEC TR 24731-1] Extensions to the C Library, — Part I: Bounds-checking interfaces, and [ISO/IEC TR 24731-2] Extensions to the C Library, — Part II: Dynamic Allocation Functions. (Several of the "Portable Equivalent" entries are specified in the POSIX standard.)

Noncompliant Code Example

In this noncompliant code example, strcat() and strcpy() are used.

enum { BUFFERSIZE=256 };

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFFERSIZE];

  strcpy(buf, prefix);
  strcat(buf, msg);
  strcat(buf, suffix);
  fputs(buf, stderr);
}

Compliant Solution

In this compliant solution, strcat() and strcpy() are replaced by strcat_s() and strcpy_s().

enum { BUFFERSIZE=256 };

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFFERSIZE];

  strcpy_s(buf, BUFFERSIZE, prefix);
  strcat_s(buf, BUFFERSIZE, msg);
  strcat_s(buf, BUFFERSIZE, suffix);
  fputs(buf, stderr);
}

Risk Assessment

The deprecated and obsolescent enumerated in this guideline are commonly associated with software vulnerabilities.

Automated Detection

Unknown.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

ISO/IEC 9945:2003

ISO/IEC 9899:1999 Section 7.21, "String handling <string.h>"

...

ISO/IEC PDTR 24731-2

MISRA Rule 20.4

Bibliography

[Burch 2006]
[CERT 2006c]
[Seacord 2005a] Chapter 2, "Strings"

...

When an analyzer determines that an out-of-bounds store cannot occur in a specific invocation of a function, the invocation of that function is permitted by this guideline, and the analyzer is not required to produce any diagnostic.

Deprecated Functions

The gets function was deprecated by Technical Corrigendum 3 to C99 and eliminated from C1X.

Obsolescent Functions

Functions in the first column of the following table are hereby defined to be obsolescent functions. To remediate invocations of obsolescent functions, an application might use inline coding that, in all respects, conforms to this guideline, or an alternative library that, in all respects, conforms to this guideline, or alternative non-obsolescent functions.

...

The asctime and ctime functions are obsolescent because they use non-reentrant static buffers and can be emulated using asctime_s and ctime_s.

Unchecked Obsolescent Functions

The following are hereby defined to be unchecked obsolescent functions:

...

Noncompliant Code Example

In this noncompliant code example, the obsolescent functions strcat and strcpy are used.

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFSIZE];

  strcpy(buf, prefix);
  strcat(buf, msg);
  strcat(buf, suffix);
  fputs(buf, stderr);
}
 

Noncompliant Code Example

In this noncompliant code example, the obsolescent function setbuf is used.

FILE *file;
/* Setup file */
setbuf(file, NULL);
/* ... */
 

Noncompliant Code Example

In this noncompliant code example, tmpnam is used.

char file_name[L_tmpnam];
FILE *fp;

if (!tmpnam(file_name)) {
  /* Handle error */
}

/* A TOCTOU race condition exists here */

fp = fopen(file_name, "wb+");
if (fp == NULL) {
   /* Handle error */
}
 

Noncompliant Code Example

In this noncompliant code example, tmpfile is used.

FILE *fp = tmpfile();
if (fp == NULL) {
  /* Handle error */
}

Related Guidelines

ISO/IEC JTC1/SC22/WG11 Rationale for TR 24731 Extensions to the C Library Part I: Bounds-checking interfaces

...

MITRE CWE: CWE-73 "External Control of File Name or Path, "CWE-367, "Time-of-check Time-of-use Race Condition," CWE-676, "Use of Potentially Dangerous Function," CWE-192, "Integer Coercion Error," CWE-197, "Numeric Truncation Error," CWE-464, "Addition of Data Structure Sentinel," CWE-676, "Use of Potentially Dangerous Function," and CWE-20, "Insufficient Input Validation"

Bibliography

[Apple Secure Coding Guide] "Avoiding Race Conditions and Insecure File Operations"
[CERT C Secure Coding Standard 2010]"MSC34-C. Do not use deprecated or obsolescent obsolete functions", "FIO01-C. Be careful using functions that use file names for identification", "FIO07-C. Prefer fseek() to rewind()", "FIO12-C. Prefer setvbuf() to setbuf()", "INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs", "INT06-C. Use strtol() or a related function to convert a string token to an integer", "STR06-C. Do not assume that strtok() leaves the parse string unchanged", "STR07-C. Use TR 24731 for remediation of existing string manipulation code"
[Drepper 2006] Section 2.2.1 "Identification When Opening"
[Klein 2002]
[Linux 2007] strtok(3)
[Open Group 2004] "The open function"
[Seacord 2005a] Chapter 2, "Strings," and Chapter 7, "File I/O"
[Seacord 2005b]

...