SEI CERT C Coding Standard

Space shortcuts

Page tree

Versions Compared

Old Version 21

changes.mady.by.user David Keaton

Saved on

compared with

New Version 22

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#FFCCCC
struct stat lstat_info;
int fd;
if (lstat("some_file", &lstat_info) == -1) {
  /* handle error */
}
if (!S_ISLNK(lstat_info.st_mode)) {
   if ((fd = open("some_file", O_RDWR)) == -1) {
       /* handle error */
   }
}
write(fd, userbuf, userlen);

Unfortunately this code is vulnerable to a TOCTOU race condition. An attacker merely has to create the malicious linked file after the lstat() function but before the open() function.

...