The C standard specifies Standard identifies specific strings to use for the mode for the function fopen(). An implementation may define extra strings that define additional modes, but only the modes in on calls to fopen() and fopen_s(). C11 provides a new mode flag, x, that provides the mechanism needed to determine if the file that is to be opened exists. To be strictly conforming and portable, one of the strings from the following table (adapted from the C99 standard) are fully portable and C99 compliant:C Standard, subclause 7.21.5.2 [ISO/IEC 9899:2011]) must be used:
Strings to Use for the Mode on Calls to fopen() and fopen_s()
|
|---|
mode string Result | |
|---|---|
|
Open text file for reading |
|
Truncate to zero length or create text file for writing | |
| Create text file for writing |
|
Append; open or create text file for writing at end-of-file |
|
Open binary file for reading |
|
Truncate to zero length or create binary file for writing | |
| Create binary file for writing |
|
Append; open or create binary file for writing at end-of-file |
|
Open text file for update (reading and writing) |
|
Truncate to zero length or create text file for update | |
| Create text file for update |
|
Append; open or create text file for update, writing at end-of-file |
|
Open binary file for update (reading and writing) |
|
Truncate to zero length or create binary file for update | |
| Create binary file for update |
|
Append; open or create binary file for update, writing at end-of-file |
If the mode string begins with one of these sequences, the implementation might choose to ignore the remaining characters, or it might use them to select different kinds of files.
When calling fopen_s(), any of the mode strings used for writing (w or a) may be prefixed with the u character to give the file system default access permissions.
An implementation may define additional mode strings, but only the modes shown in the table are fully portable and C compliant. Beware that Microsoft Visual Studio 2012 and earlier do not support the x or u mode characters [MSDN].
Risk Assessment
Using a non-standard mode will lead to undefined behavior, likely causing mode string that is not recognized by an implementation may cause the call to fopen() to fail.
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
FIO11- |
1 (low)
2 (probable)
3 (low)
P6
L2
C | Medium | Probable | Medium | P8 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Compass/ROSE | |||||||||
| LDRA tool suite |
| 590 S | Partially implemented | ||||||
| PC-lint Plus |
| 2472, 2473 | Fully supported | ||||||
| Polyspace Bug Finder |
| CERT C: Rec. FIO11-C | Checks for bad file access mode or status (rec. fully covered) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
...
Related Guidelines
Bibliography
...
...
| 9899:2011] | Subclause 7.21.5.3, |
...
"The fopen Function" |
...
The {{fopen}} function"FIO10-A. Take care when using the rename() function 009. Input Output (FIO) FIO12-A. Prefer setvbuf() to setbuf()