Page History

...

#include <stdio.h>

void open_some_file(const char *file) {
  FILE *f = fopen(file, "r");
  if (NULL != f) {
    /* File exists, handle error */
  } else {
    if (fclose(f) == EOF) {
      /* Handle error */
    }
    f = fopen(file, "w");
    if (NULL == f) {
      /* Handle error */
    }
 
    /* Write to file */
    if (fclose(f) == EOF) {
      /* Handle error */
    }
  }
}

...

#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>

void open_some_file(const char *file) {
  int fd = open(file, O_CREAT | O_EXCL | O_WRONLY);
  if (-1 != fd) {
    FILE *f = fdopen(fd, "w");
    if (NULL != f) {
      /* Write to file */

      if (fclose(f) == EOF) {
        /* Handle error */
      }
    } else {
      if (close(fd) == -1) {
        /* Handle error */
      }
    }
  }
}

Exceptions

...

FIO45-C-EX2: Accessing a file name or path name multiple times is permitted if the file referenced resides in a secure directory. (For more information, see FIO15-C. Ensure that file operations are performed in a secure directory.)

...

This POSIX code example verifies that each subsequent file access operates on the same file. In POSIX, every file can be uniquely identified by using its device and i-node attributes. This code example checks that a file name refers to a regular file (and not a directory, symbolic link, or other special file) by invoking lstat(). This call also retrieves its device and i-node. The file is subsequently opened. Finally, the program verifies that the file that was opened is the same one (matching device and i-nodes) as the file that was confirmed as a regular file.

An attacker can still exploit this code if they have the ability to delete the benign file and create the malicious file within the race window between lstat() and open(). It is possible that the OS kernel will reuse the same device and i-node for both files. This can be mitigated by making sure that the attacker lacks the permissions to delete the benign file.

Code Block
bgColor #ccccff lang c
#include <sys/stat.h> #include <fcntl.h> int open_regular_file(char *filename, int flags) { struct stat lstat_info; struct stat fstat_info; int f; if (lstat(filename, &lstat_info) == -1) { /* File does not exist, handle error */ } if (!S_ISREG(lstat_info.st_mode)) { /* File is not a regular file, handle error */ } if ((f = open(filename, flags)) == -1) { /* File has disappeared, handle error */ } if (fstat(f, &fstat_info) == -1) { /* Handle error */ } if (lstat_info.st_ino != fstat_info.st_ino || lstat_info.st_dev != fstat_info.st_dev) { /* Open file is not the expected regular file, handle error */ } /* f is the expected regular open file */ return f; }

...

Tool	Version	Checker	Description
CodeSonar	Include Page CodeSonar_V CodeSonar_V	IO.RACE	File system race condition
Coverity	Include Page Coverity_V Coverity_V	TOCTOU	Implemented
Helix QAC	Include Page Helix QAC_V Helix QAC_V	DF4851, DF4852, DF4853
Klocwork	Include Page Klocwork_V Klocwork_V	SV.TOCTOU.FILE_ACCESS
LDRA tool suite	Include Page LDRA_V LDRA_V	75 D	Partially implemented
Parasoft C/C++test	Include Page Parasoft_V Parasoft_V	CERT_C-FIO45-a	Avoid race conditions while accessing files
Polyspace Bug Finder	Include Page Polyspace Bug Finder_V Polyspace Bug Finder_V	CERT C: Rule FIO45-C	Checks for file File access between time of check and use ( TOCTOU) File or folder might change state due to access racerule partially covered)

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...