Recommendations
FIO01-A. Avoid functions that rely on file names
FIO02-A. Canonicalize file names originating from untrusted sources
FIO03-A. Do not make assumptions about fopen() and file creation
FIO04-A. Detect and handle file operation errors
Rules
FIO30-C. Exclude user input from format strings
FIO32-C. Do not assume file names generated with tmpnam() remain unique
FIO33-C. Detect and handle critical file operation errors
FIO34-C. Do not convert the value returned by a character IO function