If either of the C Standard fgets() or fgetws() functions fail, the contents of the array being written is indeterminate. (See undefined behavior 170175.) It is necessary to reset the string to a known value to avoid errors on subsequent string manipulation functions.
...
Making invalid assumptions about the contents of an array modified by fgets() or fgetws() can result in undefined behavior and 175 and abnormal program termination.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
FIO40-C | Low | Probable | Yes | YesMedium | P4P6 | L3L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| LANG.MEM.UVAR | Uninitialized Variable | ||||||
| Cppcheck Premium |
| premium-cert-fio40-c | |||||||
| Helix QAC |
| DF4861, DF4862, DF4863 | |||||||
| LDRA tool suite |
| 44 S | Enhanced enforcement | ||||||
| Parasoft C/C++test |
| CERT_C-FIO40-a | Reset strings on fgets() or fgetws() failure | ||||||
| CERT C: Rule FIO40-C | Checks for use of indeterminate string (rule partially covered) | |||||||
| PVS-Studio |
| V1024 |
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...