Secure Coding in C and C++, Second Edition

Chapter 8. File I/O

with David Riley and David Svoboda¹

1. David Riley is a professor of computer science at the University of Wisconsin–LaCrosse. David Svoboda is a member of the technical staff for the SEI’s CERT.

But, when I came,—some minute ere the time Of her awakening,—here untimely lay The noble Paris and true Romeo, dead.

—William Shakespeare, Romeo and Juliet, act V, scene 3

C and C++ programs commonly read and write to files as part of their normal operations. Numerous vulnerabilities have resulted from irregularities in how these programs interact with the file system—the operation of which is defined by the underlying operating system. Most commonly, these vulnerabilities result from file identification issues, poor privilege management, ...