Page History

...

The fopen_s() function defined in ISO/IEC TR 24731-2006 is designed to improve * the security of the fopen() function. However, like fopen(), fopen_s() provides no mechanism to determine if an existing file has been opened for writing or a new file has been created. The code below contains the same TOCTOU race condition as in the first Non-Compliant Code Example 1.

/* ... */
FILE *fptr;
errno_t res = fopen_s(&fptr,"foo.txt", "r");
if (res != 0) { /* file does not exist */
  res = fopen_s(&fptr,"foo.txt", "w");
  /* ... */
  fclose(fptr);
} else {
  fclose(fptr);
}
/* ... */

...

Compliant Solution (POSIX)

The function {{fdopen()}} \[[Open Group 04|AA. C References#Open Group 05]\] can be used in conjunction with {{open()}} to determine if a file is opened or created, and then associate a stream with the file descriptor.

...