Page History

The C fopen() function is used to open an existing file or create a new one. However, in C, fopen() does not indicate whether an existing file has been opened for writing or a new file has been created. This may The C11 version of the fopen() function provides a mode flag, x, that provides the mechanism needed to determine if the file that is to be opened exists. Not using this mode flag can lead to a program overwriting or accessing an unintended file.

...

char *file_name;
FILE *fp;

/* Initialize file_name */

fp = fopen(file_name, "w");
if (!fp) {
  /* Handle error */
}

...

Compliant Solution (fopen

...

("x"),

...

C11)

Starting in C11 a new mode suffix ("x") was added to the fopen() function which causes fopen() to return NULL if the file already exists or cannot be created

The ISO/IEC TR 24731-1 fopen_s() function is designed to improve the security of the fopen() function [ISO/IEC TR 24731-1:2007]. However, like fopen(), fopen_s() provides no mechanism to determine if an existing file has been opened for writing or a new file has been created.

char *file_name;
FILE *fp;

/* Initialize file_name */
errno_t res = fopen_s(&fp, file_name, "w");
if (res != 0) {
  /* Handle error */
}

Compliant Solution (fopen(), C11)

The C Standard provides a new flag to address this problem. Section 7.21.5.3, paragraph 5 [ISO/IEC 9899:2011], states:

...

.

...

This option is also provided by the GNU C library [Loosemore 2007].

This compliant solution uses the x mode character to instruct fopen() to fail rather than open an existing file.

char *file_name;
FILE *fp;

/* Initialize file_name */

FILE *fp = fopen(file_name, "wx");
if (!fp) {
  /* Handle error */
}

Use of this option allows for the easy remediation of legacy code.

Compliant Solution (open(), POSIX)

The open() function, as defined in the Open Group Standard for Information Technology—Portable Operating System Interface (POSIX®), Base Specifications, Issue 6 [Open Group 20047 [IEEE Std 1003.1:2013], is available on many platforms and provides finer control than fopen(). In particular, open() accepts the O_CREAT and O_EXCL flags. When used together, these flags instruct the open() function to fail if the file specified by file_name already exists.

...

EXCLUSIVE specifies that the server is to follow exclusive creation semantics, using the verifier to ensure exclusive creation of the target. No attributes may be provided in this case, since the server may use the target file metadata to store the createverf3 verifier.

For examples on of how to check for the existence of a file without opening it, see recommendation FIO10-C. Take care when using the rename() function.

...

For code that operates on FILE pointers and not file descriptors, the POSIX fdopen() function can be used to associate an open stream with the file descriptor returned by open(), as shown in this compliant solution [Open Group 2004].IEEE Std 1003.1:2013]:

char *file_name;
int new_file_mode;
FILE *fp;
int fd;

/* Initialize file_name and new_file_mode */

fd = open(file_name, O_CREAT | O_EXCL | O_WRONLY, new_file_mode);
if (fd == -1) {
  /* Handle error */
}

fp = fdopen(fd, "w");
if (fp == NULL) {
  /* Handle error */
}

Compliant Solution (Windows)

The Win32 API  CreateFile() allows a programmer to create or open a file depending on the flags passed in. Passing in the CREATE_NEW flag ensures the call fails if the file already exists. This compliant solution demonstrates how to open a file for reading and writing without sharing access to the file such that the call fails if the file already exists.

TCHAR *file_name;
HANDLE hFile = CreateFile(file_name, GENERIC_READ | GENERIC_WRITE, 0, 0, 
                          CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
if (INVALID_HANDLE_VALUE == hFile) {
  DWORD err = GetLastError();
  if (ERROR_FILE_EXISTS == err) {
    /* Handle file exists error */
  } else {
    /* Handle other error */
  }
}

Risk Assessment

The ability to determine if whether an existing file has been opened or a new file has been created provides greater assurance that a file other than the intended file is not acted upon.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...

...

Image Modified Image Modified Image Modified