Page History

The C++ Standard, [filebuf], paragraph 2 [ISO/IEC 14882-2014], states the following:

The restrictions on reading and writing a sequence controlled by an object of class basic_filebuf<charT, traits> are the same as for reading and writing with the Standard C library FILEs.

The C Standard, subclause Wiki MarkupSection 7.19.5.3 of C99 places the following restrictions on update streams: \[, paragraph 6 [ISO/IEC 9899:1999|AA. C++ References#ISO/IEC 9899-1999]\] <blockquote><p>When a file is opened with update mode both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the <code>fflush</code> function or to a file positioning function (<code>fseek</code>, <code>fsetpos</code>, or <code>rewind</code>), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file. Opening (or creating) a text file with update mode may instead open (or create) a binary stream in some implementations.</p></blockquote>Receiving input from a stream directly following an output to that stream without an intervening call to {{fflush()}}, {{fseek()}}, {{fsetpos()}}, or {{rewind()}}, or outputting to a stream after receiving input from it without a call to {{fseek()}}, {{fsetpos()}}, {{rewind()}} if the file is not at end-of-file results in [undefined behavior|BB. Definitions#undefined behavior]. Consequently, a call to {{fseek()}}, {{fflush()}} or {{fsetpos()}} is necessary between input and output to the same stream (see [FIO07-CPP. Prefer fseek() to rewind()|FIO07-CPP. Prefer fseek() to rewind()])], places the following restrictions on FILE objects opened for both reading and writing:

When a file is opened with update mode . . ., both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the fflush function or to a file positioning function (fseek, fsetpos, or rewind), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file.

Consequently, the following scenarios can result in undefined behavior:

•  Receiving input from a stream directly following an output to that stream without an intervening call to std::basic_filebuf<T>::seekoff() if the file is not at end-of-file
•  Outputting to a stream after receiving input from that stream without a call to std::basic_filebuf<T>::seekoff() if the file is not at end-of-file

No other std::basic_filebuf<T> function guarantees behavior as if a call were made to a standard C library file-positioning function, or std::fflush().

Calling std::basic_ostream<T>::seekp() or std::basic_istream<T>::seekg() eventually results in a call to std::basic_filebuf<T>::seekoff() for file stream positioning. Given that std::basic_iostream<T> inherits from both std::basic_ostream<T> and std::basic_istream<T>, and std::fstream inherits from std::basic_iostream, either function is acceptable to call to ensure the file buffer is in a valid state before the subsequent I/O operation.

Noncompliant Code Example

This noncompliant code example appends data to the end of a file and then reads from the same file. However, because there is no intervening positioning call between the formatted output and input calls, the behavior is undefined.

char data[BUFFERSIZE];
char append_data[BUFFERSIZE];
char *file_name;
FILE *file;

/* Initialize file_name */

file = fopen(file_name, "a+");
if (file == NULL#include <fstream>
#include <string>

void f(const std::string &fileName) {
  std::fstream file(fileName);
  if (!file.is_open()) {
  /* Handle error */
}

/* initialize append_data */

if (fwrite(append_data, BUFFERSIZE, 1, file) != BUFFERSIZE) {
  /* Handle error */
}
if (fread(data, BUFFERSIZE, 1, file) != 0) {
  /* Handle there not being data */
}

fclose(file);

...

Handle error
    return;
  }
  
  file << "Output some data";
  std::string str;
  file >> str;
}

Compliant Solution

In this compliant solution, fseekthe std::basic_istream<T>::seekg() function is called in between the output and input, eliminating the undefined behavior.

#include <fstream>
#include <string>

void f(const std::string &fileName) {
  std::fstream file(fileName);
  if (!file.is_open()char data[BUFFERSIZE];
char append_data[BUFFERSIZE];
char *file_name;
FILE *file;

/* initialize file_name */

file = fopen(file_name, "a+");
if (file == NULL) {
  /* Handle error */
}

/* Initialize append_data */

if (fwrite(append_data, BUFFERSIZE, 1, file) != BUFFERSIZE) {
  /* Handle error */
}

if (fseek(file, 0L, SEEK_SET) != 0) {
  /* Handle error */
}

if (fread(data, BUFFERSIZE, 1, file) != 0) {
  /* Handle there not being data */
}

fclose(file);Handle error
    return;
  }
  
  file << "Output some data";
 
  std::string str;
  file.seekg(0, std::ios::beg);
  file >> str;
}

Risk Assessment

Alternately inputting and outputting from a stream without an intervening flush or positioning call results in is undefined behavior.

Automated Detection

Fortify SCA Version 5.0 with CERT C Rule Pack can detect violations of this rule.

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Related Guidelines

This rule appears in the C Secure Coding Standard as supplements FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call.

References

...

Bibliography

...

...

...

...

...

Image Added Image Added Image Added {{fopen}} function"FIO38-CPP. Do not use a copy of a FILE object for input and output      09. Input Output (FIO)      FIO40-CPP. Reset strings on fgets() failure