FIO44-C. Only use values for fsetpos() that are returned from fgetpos()

The C Standard, 7.23.9.3 paragraph 2 [ ISO/IEC 9899:2024 ], defines the following behavior for fsetpos() :

The fsetpos function sets the mbstate_t object (if any) and file position indicator for the stream pointed to by stream according to the value of the object pointed to by pos , which shall be a value obtained from an earlier successful call to the fgetpos function on a stream associated with the same file.

Invoking the fsetpos() function with any other values for pos is undefined behavior 181 .

Noncompliant Code Example

This noncompliant code example attempts to read three values from a file and then set the file position pointer back to the beginning of the file:

#include <stdio.h>
#include <string.h>
 
int opener(FILE *file) {
  int rc;
  fpos_t offset;

  memset(&offset, 0, sizeof(offset));

  if (file == NULL) { 
    return -1;
  }

  /* Read in data from file */

  rc = fsetpos(file, &offset);
  if (rc != 0 ) {
    return rc;
  }

  return 0;
}

Only the return value of an fgetpos() call is a valid argument to fsetpos() ; passing a value of type fpos_t that was created in any other way is undefined behavior 181 .

Compliant Solution

In this compliant solution, the initial file position indicator is stored by first calling fgetpos() , which is used to restore the state to the beginning of the file in the later call to fsetpos() :

#include <stdio.h>
#include <string.h>
 
int opener(FILE *file) {
  int rc;
  fpos_t offset;

  if (file == NULL) {
    return -1;
  }

  rc = fgetpos(file, &offset);
  if (rc != 0 ) {
    return rc;
  }

  /* Read in data from file */

  rc = fsetpos(file, &offset);
  if (rc != 0 ) {
    return rc;
  }

  return 0;
}

Risk Assessment

Misuse of the fsetpos() function can position a file position indicator to an unintended location in the file.

Automated Detection

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website .

Related Guidelines

Key here (explains table format and definitions)

Bibliography