 
                            ...
| Code Block | ||||
|---|---|---|---|---|
| 
 | ||||
| #include <stdio.h>
void open_some_file(const char *file) {
  FILE *f = fopen(file, "r");
  if (NULL != f) {
    /* File exists, handle error */
  } else {
    if (fclose(f) == EOF) {
      /* Handle error */
    }
    f = fopen(file, "w");
    if (NULL == f) {
      /* Handle error */
    }
 
    /* Write to file */
    if (fclose(f) == EOF) {
      /* Handle error */
    }
  }
}
 | 
...
TOCTOU race conditions can result in unexpected behavior, including privilege escalation.
| Rule | Severity | Likelihood | Detectable | Remediation Cost Repairable | Priority | Level | 
|---|---|---|---|---|---|---|
| FIO45-C | High | Probable | No | NoHigh | P6 | L2 | 
Automated Detection
| Tool | Version | Checker | Description | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
| CodeSonar | 
 | IO.RACE | File system race condition | |||||||
| Coverity | 
 | TOCTOU | Implemented | |||||||
| Cppcheck Premium | 
 | premium-cert-fio45-c | ||||||||
| Helix QAC | C4851
 | C4852, C4853C++4851, C++4852, C++4853DF4851, | DF4852, DF4853 | |||||||
| Klocwork | 
 | SV.TOCTOU.FILE_ACCESS | ||||||||
| LDRA tool suite | 
 | 75 D | Partially implemented | |||||||
| Parasoft C/C++test | 
 | CERT_C-FIO45-a | Avoid race conditions while accessing files | |||||||
| Polyspace Bug Finder | 
 | CERT C: Rule FIO45-C | fullyChecks for file access between time of check and use (rule | partially covered) | 
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...