Page History

...

#include <stdio.h>
#include <fcntl.h>
 
int func(const char *filename) {
  int fd = open(filename, O_RDONLY, S_IRUSR);
  if (-1 == fd) {
    return -1;
  }
  /* ... */
  return 0;
}

Compliant Solution (POSIX)

...

Failing to properly close files may allow an attacker to exhaust system resources and can increase the risk that data written into in-memory file buffers will not be flushed in the event of abnormal program termination.

Automated Detection

This rule is stricter than rule [fileclose] in ISO/IEC TS 17961:2013. Analyzers that conform to the technical standard may not detect all violations of this rule.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

CERT-CWE Mapping Notes

Key here for mapping notes

...

• Failure to free resources besides files or memory chunks, such as mutexes)

CWE-403 and FIO42-C

CWE-403 - FIO42-C = list, where list =

• A process

  does not close sensitive file descriptors before invoking

  opens and closes a sensitive file descriptor, but also executes a child process

  , but the child process is invoked before the lifetime of the last pointer that stores the return value of the call (to open sensitive file descriptors) has ended. 

  while the file descriptor is open.

FIO42-C - CWE-403 = SPECIAL_CASES, where SPECIAL_CASES =

• Sensitive file descriptors are not left open before invoking a child process, but a function with open and close resources, such as the POSIX open() and close() functions, is not matched with a call to close the file before the lifetime of the last pointer that stores the return value of the call has ended or before normal program termination, whichever occurs first

  A program opens a file descriptor and fails to close it, but does not invoke any child processes while the file descriptor is open.

Bibliography

...