Page History

The C fopen() function is used to open an existing file or create a new one. However, in C, fopen() does not indicate whether an existing file has been opened for writing or a new file has been created. This may The C11 version of the fopen() and fopen_s() provides a mode flag 'x' that provides the mechanism needed to determine if the file that is to be opened exists.  Not using this mode flag can lead to a program overwriting or accessing an unintended file.

...

char *file_name;
FILE *fp;

/* Initialize file_name */

fp = fopen(file_name, "w");
if (!fp) {
  /* Handle error */
}

Noncompliant Code Example (fopen_s(),

...

C11 Annex K)

The ISO/IEC TR 24731-1 C11 Annex K fopen_s() function is designed to improve the security of the fopen() function [ISO/IEC TR 24731-1:2007]. However, like 9899:2011]. Like the C11 fopen(), the C11 Annex K fopen_s() provides no a mechanism to determine if an existing file has been opened for writing or a new file has been createdthe file exists.  See below for use of the exclusive mode flag.

char *file_name;
FILE *fp;

/* Initialize file_name */
errno_t res = fopen_s(&fp, file_name, "w");
if (res != 0) {
  /* Handle error */
}

...

...