Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: REM Cost Reform

The C Standard, 7.2123.9.3 paragraph 2 [ISO/IEC 9899:20112024], defines the following behavior for fsetpos():

...

Invoking the fsetpos() function with any other values for pos is undefined behavior 181.

Noncompliant Code Example

...

Only the return value of an fgetpos() call is a valid argument to fsetpos(); passing a value of type fpos_t that was created in any other way is undefined behavior 181.

Compliant Solution

In this compliant solution, the initial file position indicator is stored by first calling fgetpos(), which is used to restore the state to the beginning of the file in the later call to fsetpos():

...

Misuse of the fsetpos() function can position a file position indicator to an unintended location in the file.

Rule

Severity

Likelihood

Detectable

RepairableRemediation Cost

Priority

Level

FIO44-C

Medium

Unlikely

No

MediumNo

P4P2

L3

Automated Detection

Tool

Version

Checker

Description

CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
(customization)Users can add a custom check for violations of this constraint.
Compass/ROSE



Can detect common violations of this rule. However, it cannot handle cases in which the value returned by fgetpos() is copied between several variables before being passed to fsetpos()

Cppcheck Premium

Include Page
Cppcheck Premium_V
Cppcheck Premium_V

premium-cert-fio44-c
Helix QAC

Include Page
Helix QAC_V
Helix QAC_V

DF4841, DF4842, DF4843


Klocwork

Include Page
Klocwork_V
Klocwork_V

CERT.FSETPOS.VALUE


LDRA tool suite
Include Page
LDRA_V
LDRA_V

82 D

Fully implemented

Parasoft C/C++test

Include Page
Parasoft_V
Parasoft_V

CERT_C-FIO44-aOnly use values for fsetpos() that are returned from fgetpos()
Polyspace Bug Finder

Include Page
Polyspace Bug Finder_V
Polyspace Bug Finder_V

Invalid file positionfsetpos() is invoked with a file position argument not obtained from fgetpos()


CERT C: Rule FIO44-CChecks for invalid file position (rule partially covered)
PVS-Studio

Include Page
PVS-Studio_V
PVS-Studio_V

V1035

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

...

Bibliography

[ISO/IEC 9899:20112024]7.2123.9.3, "The fsetpos Function"

...