Page History

The C99 fopen() function has the capability to open files can open streams to which both input and output are capablemay be performed. This functionality is known as "update" mode and is signified by using '+' as the second or third character in the mode string to fopen().

...

When a file is opened with update mode ('+' as the second or third character in the above list of mode argument values), both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the fflush function or to a file positioning function (fseek, fsetpos, or rewind), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file. Opening (or creating) a text file with update mode may instead open (or create) a binary stream in some implementations.

Therefore either receiving Receiving input from a stream directly following an output to that stream without an intervening call to fflush(), fseek(), fsetpos(), or rewind(), or outputting to a stream after receiving input from it without a call to fseek(), fsetpos(), rewind() if the file is not at end-of-file results in undefined behavior. Consequently a call to one of these functions is necessary in between input and output to the same stream in most cases.

Non-Compliant Code Example

The following non-compliant code appends data to a file and then reads from the same file.

char data[BUF_SIZ];
char append_data[BUF_SIZ];
FILE *file;

file = fopen(file_name, "a+");
if (file == NULL) {
  /* handle error */
}

/* Initialize append_data */

if(fwrite(append_data, BUF_SIZ, 1, data) != BUF_SIZ) {
  /* Handle error */
}
if (fread(data, BUF_SIZ, 1, file) != 0) {
  /* Handle there not being data */
}

fclose(file);

However, since because the stream is not flushed in between the call to fread() and fwrite(), the behavior is undefined behavior results.

Compliant Solution

In this compliant solution, fflush() is called in between the output and input, removing eliminating the undefined behavior.

char data[BUF_SIZ];
char append_data[BUF_SIZ];
FILE *file;

file = fopen(file_name, "a+");
if (file == NULL) {
  /* handle error */
}

/* Initialize append_data */

if(fwrite(append_data, BUF_SIZ, 1, data) != BUF_SIZ) {
  /* Handle error */
}
fflush(file);
if (fread(data, BUF_SIZ, 1, file) != 0) {
  /* Handle there not being data */
}

fclose(file);

Risk Assessment

TODO, causing unexpected program behavior and possibly a data integrity violationAlternately inputing and outputing from a stream without an intervening flush or positioning call results in undefined behavior.

Automated Detection

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.5.3, "The {{fopen}} function"

...