Page History

Opening a file that is already open has implementation-defined behavior. While some platforms may forbid a file simultaneously being opened multiple times, platforms that allow it may facilitate dangerous race conditions, according to the C Standard, 7.21.3, paragraph 8 [ISO/IEC 9899:2011]:

Functions that open additional (nontemporary) ﬁles require a file name, which is a string. The rules for composing valid ﬁle names are implementation-deﬁned. Whether the same file can be simultaneously open multiple times is also implementation-deﬁned.

Some implementations do not allow multiple copies of the same file to be open at the same time. Consequently, portable code cannot depend on what will happen if this rule is violated. Even on implementations that do not outright fail to open an already-opened file, a TOCTOU (time-of-check, time-of-use) race condition exists in which the second open could operate on a different file from the first due to the file being moved or deleted (see FIO45-C. Avoid TOCTOU race conditions while accessing files for more details on TOCTOU race conditions).

Noncompliant Code Example

This noncompliant code example logs the program's state at runtime.:

Code Block

bgColor	#ffcccc
lang	c

#include <stdio.h>
 
void do_stuff(void) {
  FILE *logfile = fopen("log", "a");
  if (logfile == NULL) {
    /* Handle error */
  }

  /* Write logs pertaining to do_stuff() */
  fprintf(logfile, "do_stuff\n");

  /* ... */
}

int main(void) {
  FILE *logfile = fopen("log", "a");
  if (logfile == NULL) {
    /* Handle error */
  }

  /* Write logs pertaining to main() */
  fprintf(logfile, "main\n");

  do_stuff();
 
  if (fclose(logfile) == EOF) {
    /* Handle ...error */
  }
  return 0;
}

However, Because the file log is opened twice simultaneously. The result is implementation-defined and potentially dangerous.

Implementation Details

On a Linux machine running gcc 4.3.2, this program produces

Code Block
do_stuff main

which does not indicate the order in which data was logged(once in main() and again in do_stuff()), this program has implementation-defined behavior.

Compliant Solution

In this compliant solution, a reference to the file pointer is passed as an argument to functions that need to perform operations on that file. This reference eliminates the need to open the same file multiple times.

Code Block

bgColor	#ccccff
lang	c

#include <stdio.h>
 
void do_stuff(FILE *logfile) {
  /* Write logs pertaining to do_stuff() */
  fprintf(logfile, "do_stuff\n");

  /* ... */
}

int main(void) {
  FILE *logfile = fopen("log", "a");
  if (logfile == NULL) {
    /* Handle error */
  }

  /* Write logs pertaining to main() */
  fprintf(logfile, "main\n");

  do_stuff(logfile);
 
  if (fclose(logfile) == EOF) {
    /* Handle ...error */
  }
  return 0;
}

Implementation Details

On a Linux machine running GCC 4.3.2, this program produces

Code Block
main do_stuff

...

Risk Assessment

Simultaneously opening a file multiple times can result in abnormal program termination or data integrity violationsunexpected errors and nonportable behavior.

Rule	Severity	Likelihood

Remediation Cost

Detectable	Repairable	Priority	Level

FIO31

FIO24-C

Medium

medium

Probable

probable

No

high

No

P4

L3

Related Vulnerabilities

Automated Detection

Tool

Version

Checker

Description

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

IO.RACE
(customization)

IO.BRAW

File system race condition
Users can implement a custom check that triggers a warning if a file-opening function is called on a file that is already open

File Open for Both Read and Write

LDRA tool suite

Include Page