Page History

...

When a file is opened with update mode . . ., both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the fflush function or to a file positioning function (fseek, fsetpos, or rewind), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file.

ThusConsequently, the following scenarios can result in undefined behavior:

...

No other std::basic_filebuf<T> function guarantees behavior as if a call were made to a Standard standard C library file-positioning function, or std::fflush().

Note that calling std::basic_ostream<T>::seekp() or std::basic_istream<T>::seekg() eventually results in a call to std::basic_filebuf<T>::seekoff() for file stream positioning. Given that std::basic_iostream<T> inherits from both std::basic_ostream<T> and std::basic_istream<T>, and std::fstream inherits from std::basic_iostream, either function is acceptable to call to ensure the file buffer is in a valid state prior to before the subsequent IO operation.

...

This noncompliant code example appends data to the end of a file , and then reads from the same file. However, because there is no intervening positioning call between the formatted output and input calls, the behavior is undefined.

#include <fstream>
#include <string>

void f(const std::string &N) {
  std::fstream f(N);
  if (!f.is_open()) {
    // Handle error
    return;
  }
  
  f << "Output some data";
  std::string str;
  f >> str;
}

...

In this compliant solution, the std::basic_istream<T>::seekg() function is called in between the output and input, eliminating the undefined behavior.

#include <fstream>
#include <string>

void f(const std::string &N) {
  std::fstream f(N);
  if (!f.is_open()) {
    // Handle error
    return;
  }
  
  f << "Output some data";
 
  std::string str;
  f.seekg(0, std::ios::beg);
  f >> str;
}

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...