...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
void open_some_file(const char *file) {
FILE *f = fopen(file, "r");
if (NULL != f) {
/* File exists, handle error */
} else {
if (fclose(f) == EOF) {
/* Handle error */
}
f = fopen(file, "w");
if (NULL == f) {
/* Handle error */
}
/* Write to file */
if (fclose(f) == EOF) {
/* Handle error */
}
}
}
|
...
TOCTOU race conditions can result in unexpected behavior, including privilege escalation.
Rule | Severity | Likelihood | Detectable | Remediation Cost Repairable | Priority | Level |
|---|---|---|---|---|---|---|
FIO45-C | High | Probable | No | NoHigh | P6 | L2 |
Automated Detection
Tool | Version | Checker | Description | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| IO.RACE | File system race condition | |||||||
| Coverity |
| TOCTOU | Implemented | |||||||
| Cppcheck Premium |
| premium-cert-fio45-c | ||||||||
| Helix QAC |
| DF4851, DF4852, DF4853 | ||||||||
| Klocwork |
| SV.TOCTOU.FILE_ACCESS | ||||||||
| LDRA tool suite |
| 75 D | Partially implemented | |||||||
| Parasoft C/C++test |
| CERT_C-FIO45-a | Avoid race conditions while accessing files | |||||||
| Polyspace Bug Finder |
| CERT C: Rule FIO45-C | Checks for file access between time of check and use (rule | fully partially covered) |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...