...
Remember to always call fgetpos() before fsetpos() (see FIO44-C. Only use values for fsetpos() that are returned from fgetpos()).
Automated Detection
The tool Compass/ROSE can easily identify two instances of the ungetc() function inside a function. Determining if one instance of ungetc() being invoked twice is better handled by dynamic analysis.
Risk Assessment
If used improperly, ungetc() can cause data to be truncated or lost.
...