Input Output (FIO)
- FIO30-C. Exclude user input from format strings
- FIO32-C. Do not perform operations on devices that are only appropriate for files
- FIO34-C. Distinguish between characters read from a file and EOF or WEOF
- FIO37-C. Do not assume that fgets() or fgetws() returns a nonempty string when successful
- FIO38-C. Do not copy a FILE object
- FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call
- FIO40-C. Reset strings on fgets() or fgetws() failure
- FIO41-C. Do not call getc(), putc(), getwc(), or putwc() with a stream argument that has side effects
- FIO42-C. Close files when they are no longer needed
- FIO44-C. Only use values for fsetpos() that are returned from fgetpos()
- FIO45-C. Avoid TOCTOU race conditions while accessing files
- FIO46-C. Do not access a closed file
- FIO47-C. Use valid format strings
Risk Assessment Summary
| Rule | Severity | Likelihood | Detectable | Repairable | Priority | Level |
|---|---|---|---|---|---|---|
| FIO30-C | High | Likely | Yes | No | P18 | L1 |
| FIO32-C | Medium | Unlikely | No | No | P2 | L3 |
| FIO34-C | High | Probable | Yes | Yes | P18 | L1 |
| FIO37-C | High | Probable | Yes | Yes | P18 | L1 |
| FIO38-C | Low | Probable | Yes | No | P4 | L3 |
| FIO39-C | Low | Likely | Yes | No | P6 | L2 |
| FIO40-C | Low | Probable | Yes | Yes | P6 | L2 |
| FIO41-C | Low | Unlikely | Yes | Yes | P3 | L3 |
| FIO42-C | Medium | Unlikely | No | No | P2 | L3 |
| FIO44-C | Medium | Unlikely | No | No | P2 | L3 |
| FIO45-C | High | Probable | No | No | P6 | L2 |
| FIO46-C | Medium | Unlikely | No | No | P2 | L3 |
| FIO47-C | High | Unlikely | Yes | No | P6 | L2 |