The following functions are obsolescent and should be avoided in favor of either the portable equivalent or, if available, the more secure alternatives defined in \[[ISO/IEC TR 24731-1|AA. Bibliography#ISO/IEC TR 24731-1-2007]\] Extensions to the C Library, --- Part I: Bounds-checking interfaces, and \[[ISO/IEC TR 24731-2|AA. Bibliography#ISO/IEC TR 24731-2-2010]\] Extensions to the C Library, --- Part II: Dynamic Allocation Functions. (Several of the "Portable Equivalent" entries are specified in the POSIX standard.)

enum { BUFFERSIZE=256 };

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFFERSIZE];

  strcpy(buf, prefix);
  strcat(buf, msg);
  strcat(buf, suffix);
  fputs(buf, stderr);
}

enum { BUFFERSIZE=256 };

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFFERSIZE];

  strcpy_s(buf, BUFFERSIZE, prefix);
  strcat_s(buf, BUFFERSIZE, msg);
  strcat_s(buf, BUFFERSIZE, suffix);
  fputs(buf, stderr);
}

\[[Burch 2006|AA. Bibliography#Burch06]\]
\[[CERT 2006c|AA. Bibliography#CERT 06c]\]
\[[Seacord 2005a|AA. Bibliography#Seacord 05a]\] Chapter 2, "Strings"

The {{atof, atoi, atol}}, and {{atoll}} functions are obsolescent because the {{strod, strtof, strtol, strtold, strtoll, strotul}}, and {{strtoull}} functions can emulate their usage and have more robust error handling capabilities. See guideline [INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs|seccode:INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs] \[[CERT C Secure Coding Standard 2010|Bibliography#CERT C Secure Coding Standard 10]\].

The {{fopen}} and {{freopen}} functions are obsolescent because the {{fopen_s}} and {{freopen_s}} functions can emulate their usage and improve security by protecting the file from unauthorized access by setting its file protection and opening the file with exclusive access \[[ISO/IEC WG14 N1173|Bibliography#ISO/IEC WG14 N1173]\].

The {{setbuf}} function is obsolescent because {{setbuf}} does not return a value and can be emulated using {{setvbuf}}. See guideline [FIO12-C. Prefer setvbuf() to setbuf()|seccode:FIO12-C. Prefer setvbuf() to setbuf()] \[[CERT C Secure Coding Standard 2010|Bibliography#CERT C Secure Coding Standard 10]\].

The {{rewind}} function is obsolescent because {{rewind}} does not return a value and can be emulated using {{fseek}}. See guideline [FIO07-C. Prefer fseek() to rewind()|seccode:FIO07-C. Prefer fseek() to rewind()] \[[CERT C Secure Coding Standard 2010|Bibliography#CERT C Secure Coding Standard 10]\].

void complain(const char *msg) {
  static const char prefix[] = "Error: ";
  static const char suffix[] = "\n";
  char buf[BUFSIZE];

  strcpy(buf, prefix);
  strcat(buf, msg);
  strcat(buf, suffix);
  fputs(buf, stderr);
}
 

FILE *file;
/* Setup file */
setbuf(file, NULL);
/* ... */
 

char file_name[L_tmpnam];
FILE *fp;

if (!tmpnam(file_name)) {
  /* Handle error */
}

/* A TOCTOU race condition exists here */

fp = fopen(file_name, "wb+");
if (fp == NULL) {
   /* Handle error */
}
 

FILE *fp = tmpfile();
if (fp == NULL) {
  /* Handle error */
}

\[[Apple Secure Coding Guide|Bibliography#Apple Secure Coding Guide]\] "Avoiding Race Conditions and Insecure File Operations"
\[[CERT C Secure Coding Standard 2010|Bibliography#CERT C Secure Coding Standard 10]\]"[MSC34-C. Do not use deprecated or obsolescent functions|seccode:MSC34-C. Do not use deprecated or obsolescent functions]", "[FIO01-C. Be careful using functions that use file names for identification|seccode:FIO01-C. Be careful using functions that use file names for identification]", "[FIO07-C. Prefer fseek() to rewind()|seccode:FIO07-C. Prefer fseek() to rewind()]", "[FIO12-C. Prefer setvbuf() to setbuf()|seccode:FIO12-C. Prefer setvbuf() to setbuf()]", "[INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs|seccode:INT05-C. Do not use input functions to convert character data if they cannot handle all possible inputs]", "[INT06-C. Use strtol() or a related function to convert a string token to an integer|seccode:INT06-C. Use strtol() or a related function to convert a string token to an integer]", "[STR06-C. Do not assume that strtok() leaves the parse string unchanged|seccode:STR06-C. Do not assume that strtok() leaves the parse string unchanged]", "[STR07-C. Use TR 24731 for remediation of existing string manipulation code|STR07-C. Use the bounds-checking interfaces for remediation of existing string manipulation code]"
\[[Drepper 2006|Bibliography#Drepper 06]\] Section 2.2.1 "Identification When Opening"
\[[Klein 2002|Bibliography#Klein 02]\]
\[[Linux 2007|Bibliography#Linux 07]\] {{strtok}}(3)
\[[Open Group 2004|Bibliography#Open Group 04]\] "The {{open}} function"
\[[Seacord 2005a|Bibliography#Seacord 05a]\] Chapter 2, "Strings," and Chapter 7, "File I/O"
\[[Seacord 2005b|Bibliography#Seacord 05b]\]