Page History

The C99 fopen() function has the capability to open files to which both input and output are capable. This functionality is known as "update" mode and is signified by using '+' as the second or third character in the mode string to fopen().However, section 7.19.5.3 of C99 places the following restriction C Standard, 7.23.5.3, paragraph 7 [ISO/IEC 9899:2024], places the following restrictions on update streams:

When a file is opened with update mode ('+' as the second or third character in the above list of mode argument values), both . . ., both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the fflush function or to a file positioning function (fseek, fsetpos, or rewind), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file. Opening (or creating) a text file with update mode may instead open (or create) a binary stream in some implementations.

The following scenarios can result in undefined behavior.

...

(See undefined behavior 151.)

•  Receiving input from a stream directly following an output to that stream without an intervening call to fflush(), fseek(), fsetpos(), or rewind()

...

• if the file is not at end-of-file
•  Outputting to a stream after receiving input from

...

• that stream without a call to fseek(), fsetpos(), or rewind() if the file is not at end-of-file

...

Consequently, a call to

...

fseek(), fflush(), or fsetpos() is necessary

...

between input and output to the same stream

...

. See ERR07-C. Prefer functions that support error checking over equivalent functions that don't for more information on why fseek() is preferred over rewind().

Noncompliant Code Example

This noncompliant code example appends data to a file and then reads from the same file:

Non-Compliant Code Example

The following non-compliant code reads data from a presumably random area of a file, and then appends data to the end of it.

#include <stdio.h>
 
enum { BUFFERSIZE = 32 };

extern void initialize_data(char *data[BUF_SIZE];
char append_data[BUF_SIZE];
size_t append_size;
FILE *, size_t size);
 
void func(const char *file_name) {
  char data[BUFFERSIZE];
  char append_data[BUFFERSIZE];
  FILE *file;

  file = fopen(file_name, "a+");
  if (file == NULL) {
    /* handleHandle error */
  }
 
  initialize_data(append_data, BUFFERSIZE);

  if (freadfwrite(append_data, BUF_SIZ1, 1BUFFERSIZE, file) != 0BUFFERSIZE) {
    /* Handle there not being data error */
  }

/* Do something with data 
   Initialize append_data and append_size */

if(fwrite(append_data, append_size, 1, data) != append_size  if (fread(data, 1, BUFFERSIZE, file) < BUFFERSIZE) {
    /* Handle there not being data */
  }

  if (fclose(file) == EOF) {
    /* Handle error */
  }

fclose(file);
}

Because there is no intervening flush or positioning call between the calls However, since the stream is not flushed in between the call to fread() and fwrite(), the behavior is undefined behavior results.

Compliant Solution

In this compliant solution, fflushfseek() is called in between the output and input, removing eliminating the undefined behavior.:

#include <stdio.h>
 
enum { BUFFERSIZE = 32 };
extern void initialize_data(char *data, size_t size);
 
void func(const char *file_name) {
  char data[BUFFERSIZE];
  char append_data[BUFFERSIZE];
  FILE *file;

  file 
char data[BUF_SIZE];
char append_data[BUF_SIZE];
size_t append_size;
FILE *file = fopen(file_name, "a+");
  if (file == NULL) {
    /* handleHandle error */
  }

  initialize_data(append_data, BUFFERSIZE);
  if (freadfwrite(append_data, BUF_SIZBUFFERSIZE, 1, file) != 0BUFFERSIZE) {
    /* Handle there not being data error */
  }

/* Do something with data   if (fseek(file, 0L, SEEK_SET) != 0) {
   Initialize append_data and append_size/* Handle error */

fflush(file);

if(fwrite(append_  }

  if (fread(data, append_sizeBUFFERSIZE, 1, datafile) != append_size0) {
    /* Handle error there not being data */
  }

  if (fclose(file);
) == EOF) {
    /* Handle error */
  }
}

Risk Assessment

TODO, causing unexpected program behavior and possibly a data integrity violationAlternately inputting and outputting from a stream without an intervening flush or positioning call is undefined behavior.

Automated Detection

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[ISO/IEC 9899:1999|AA. C References#ISO/IEC 9899-1999]\] Section 7.19.5.3, "The {{fopen}} function"

Related Guidelines

Key here (explains table format and definitions)

CERT-CWE Mapping Notes

Key here for mapping notes

CWE-664 and FIO39-C

CWE-664 = Union( FIO39-C, list) where list =

• Improper use of an object (besides alternating reading/writing a file stream without an intervening flush

This CWE is vague on what constitutes “improper control of a resource”. It could include any violation of an object’s method constraints (whether they are documented or not). Or it could be narrowly interpreted to mean object creation and object destruction (which are covered by other CWEs).

Bibliography

...

Image Added Image Added Image AddedFIO38-C. Do not use a copy of a FILE object for input and output      09. Input Output (FIO)       FIO40-C. Reset strings on fgets() failure