If this happens, as it does in POSIX systems, the child process will be able to access the contents of the potentially sensitive file called file_name.Įxtern const char *get_validated_editor(void) If the system() function is implemented in a way that spawns a child process, then the child process could inherit the file descriptors opened by its parent. The function returns a command for invoking the editor which is subsequently passed as a command system() function. Canonicalize path names originating from tainted sources. The get_validated_editor() function retrieves the registered editor from the EDITOR environment variable and sanitizes it to be a valid editor in accordance with FIO02-C. In this noncompliant code example, derived from a vulnerability in OpenBSD's chpass program, a file containing sensitive data is opened for reading. The behavior of a program is undefined when it uses the value of a pointer to a FILE object after the associated file is closed (see undefined behavior 148.) Programs that close the standard streams (especially stdout but also stderr and stdin) must be careful not to use the stream objects in subsequent function calls, particularly those that implicitly operate on such objects (such as printf(), perror(), and getc()). To prevent file descriptor leaks and to guarantee that any buffered data will be flushed into permanent storage, files must be closed when they are no longer needed. In addition, keeping files open longer than necessary increases the risk that data written into in-memory file buffers will not be flushed in the event of abnormal program termination. This phenomenon is sometimes called file descriptor leakage, although file pointers may also be used as an attack vector. Consequently, portable programs must either avoid keeping more than FOPEN_MAX files at the same time or be prepared for functions such as fopen() to fail due to resource exhaustion.įailing to close files when they are no longer needed may allow attackers to exhaust, and possibly manipulate, system resources. The value of the macro is guaranteed to be at least 8. The number of files that an implementation guarantees may be open simultaneously is bounded by the FOPEN_MAX macro defined in. Standard FILE objects and their underlying representation (file descriptors on POSIX platforms or handles elsewhere) are a finite resource that must be carefully managed.

Open fds file