MSC34-C. Do not use deprecated or obsolete functions

Do not use deprecated or obsolete functions when more secure equivalent functions are available. Deprecated functions are defined by the C Standard. Obsolete functions are typically functions for which there are more secure or portable alternatives available and are defined by this rule.

Deprecated Functions

The gets function was deprecated by Technical Corrigendum 3 to C99 and eliminated from C11.

Obsolete Functions

Functions in the first column of the following table are hereby defined to be obsolete functions. To remediate invocations of obsolete functions, an application might use inline coding that, in all respects, conforms to this guideline, or an alternative library that, in all respects, conforms to this guideline, or alternative nonobsolete functions.

The atof, atoi, atol, and atoll functions are obsolete because the strod, strtof, strtol, strtold, strtoll, strotul, and strtoull functions can emulate their usage and have more robust error-handling capabilities. See INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs.

The fopen and freopen functions are obsolete because the fopen_s and freopen_s functions can emulate their usage and improve security by protecting the file from unauthorized access by setting its file protection and opening the file with exclusive access [ISO/IEC WG14 N1173].

The setbuf function is obsolete because setbuf does not return a value and can be emulated using setvbuf. See FIO12-C. Prefer setvbuf() to setbuf().

The rewind function is obsolete because rewind does not return a value and can be emulated using fseek. See FIO07-C. Prefer fseek() to rewind().

The asctime and ctime functions are obsolete because they use non-reentrant static buffers and can be emulated using asctime_s and ctime_s.

Unchecked Obsolete Functions

The following are hereby defined to be unchecked obsolete functions:

To remediate invocations of unchecked obsolete functions, an application might use inline coding that, in all respects, conforms to this guideline, or an alternative library that, in all respects, conforms to this guideline, or alternative nonobsolete functions from ISO/IEC TR 24731 (Part I):

or alternative nonobsolete functions from ISO/IEC TR 24731-2:2010 (Part II):

Noncompliant Code Example

In this noncompliant code example, the obsolete functions strcat and strcpy are used.

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFSIZE];

  strcpy(buf, prefix);
  strcat(buf, msg);
  strcat(buf, suffix);
  fputs(buf, stderr);
}

Compliant Solution

In this compliant solution, strcat() and strcpy() are replaced by strcat_s() and strcpy_s().

enum { BUFFERSIZE=256 };

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFFERSIZE];

  strcpy_s(buf, BUFFERSIZE, prefix);
  strcat_s(buf, BUFFERSIZE, msg);
  strcat_s(buf, BUFFERSIZE, suffix);
  fputs(buf, stderr);
}

Noncompliant Code Example

In this noncompliant code example, the obsolete function setbuf is used.

FILE *file;
/* Setup file */
setbuf(file, NULL);
/* ... */

Compliant Solution

In this compliant solution, function setvbuf is used instead.

FILE *file;
/* Setup file */
setvbuf(file, NULL, _IONBF, BUFSIZ);
/* ... */

Noncompliant Code Example

In this noncompliant code example, tmpnam is used.

char file_name[L_tmpnam];
FILE *fp;

if (!tmpnam(file_name)) {
  /* Handle error */
}

/* A TOCTOU race condition exists here */

fp = fopen(file_name, "wb+");
if (fp == NULL) {
   /* Handle error */
}

Compliant Solution

In this compliant solution, mkostemp is used instead.

static const char temp_file_template[] = TEMP_DIR DIR_SEPARATOR "xyzzy_XXXXXX";
char file_name[sizeof(temp_file_template)];
FILE *fp;
int fd;

strcpy_s(file_name, sizeof(temp_file_template), temp_file_template);
fd = mkostemp(file_name, O_RDWR | O_CREAT | O_TRUNC);
if (fd == -1) {
  /* Handle error */
}

fp = fdopen(fd, "wb+");
if (fp == NULL) {
   /* Handle error */
}

Noncompliant Code Example

In this noncompliant code example, tmpfile is used.

FILE *fp = tmpfile();
if (fp == NULL) {
  /* Handle error */
}

Compliant Solution

In this compliant solution,

Exceptions

MSC34-EX1: If an out-of-bounds store cannot occur in a specific invocation of a function, the invocation of that function is permitted by this rule. The rationale for this exception is that the simple use of such a function in a program does not mean the program is incorrect. To eliminate the use of such a function, the programmer must replace calls to the deprecated or obsolete function with calls to the alternative functions. Unfortunately, the process of modifying existing code frequently introduces defects and vulnerabilities and is not recommended. New code should be developed in conformance to this guideline, however.

Risk Assessment

The deprecated and obsolete functions enumerated in this guideline are commonly associated with software vulnerabilities.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography