CertC++-FIO50¶

Do not alternately input and output from a file stream without an intervening positioning call

Required inputs: IR, StaticSemanticAnalysis

The C++ Standard, [filebuf], paragraph 2 [ ISO/IEC 14882-2014], states the following:

The restrictions on reading and writing a sequence controlled by an object of class basic_filebuf<charT, traits> are the same as for reading and writing with the Standard C library FILEs.

The C Standard, subclause 7.19.5.3, paragraph 6 [ ISO/IEC 9899:1999], places the following restrictions on FILE objects opened for both reading and writing:

When a file is opened with update mode . . ., both input and output may be performed on the associated stream. However, output shall not be directly followed by input without an intervening call to the fflush function or to a file positioning function ( fseek, fsetpos, or rewind), and input shall not be directly followed by output without an intervening call to a file positioning function, unless the input operation encounters end-of-file.

Consequently, the following scenarios can result in undefined behavior:

Receiving input from a stream directly following an output to that stream without an intervening call to std::basic_filebuf<T>::seekoff() if the file is not at end-of-file
Outputting to a stream after receiving input from that stream without a call to std::basic_filebuf<T>::seekoff() if the file is not at end-of-file

No other std::basic_filebuf<T> function guarantees behavior as if a call were made to a standard C library file-positioning function, or std::fflush().

Calling std::basic_ostream<T>::seekp() or std::basic_istream<T>::seekg() eventually results in a call to std::basic_filebuf<T>::seekoff() for file stream positioning. Given that std::basic_iostream<T> inherits from both std::basic_ostream<T> and std::basic_istream<T>, and std::fstream inherits from std::basic_iostream, either function is acceptable to call to ensure the file buffer is in a valid state before the subsequent I/O operation.

Noncompliant Code Example

This noncompliant code example appends data to the end of a file and then reads from the same file. However, because there is no intervening positioning call between the formatted output and input calls, the behavior is undefined.

#include <fstream>
#include <string>

void f(const std::string &fileName) {
  std::fstream file(fileName);
  if (!file.is_open()) {
    // Handle error
    return;
  }

  file << "Output some data";
  std::string str;
  file >> str;
}

Compliant Solution

In this compliant solution, the std::basic_istream<T>::seekg() function is called between the output and input, eliminating the undefined behavior.

#include <fstream>
#include <string>

void f(const std::string &fileName) {
  std::fstream file(fileName);
  if (!file.is_open()) {
    // Handle error
    return;
  }

  file << "Output some data";
 
  std::string str;
  file.seekg(0, std::ios::beg);
  file >> str;
}

Risk Assessment

Alternately inputting and outputting from a stream without an intervening flush or positioning call is undefined behavior.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
FIO50-CPP	Low	Likely	Medium	P6	L2

Related Guidelines

This rule supplements FIO39-C. Do not alternately input and output from a stream without an intervening flush or positioning call.

Bibliography

[ ISO/IEC 9899:1999]	Subclause 7.19.5.3, "The `fopen` Function"
[ ISO/IEC 14882-2014]	Clause 27, "Input/Output Library"

Excerpt from SEI CERT C++ Coding Standard [https://cmu-sei.github.io/secure-coding-standards/sei-cert-cpp-coding-standard/rules/input-output-fio/fio50-cpp], Copyright (C) 1995-2026 Carnegie Mellon University. See section 9.4. "3rd-Party Licenses" in the documentation for full details.

Possible Messages

Key	Text	Severity	Disabled
alternating_input_output	Alternating input and output without intervening flush or positioning.	None	False
possibly_alternating_input_output	Possibly alternating input and output without intervening flush or positioning. References a stream from outside the routine.	None	False

Options¶

This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity
The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions

consider_std_fstream¶

consider_std_fstream : bool = True

Whether streams based on std::fstream should be considered.

consider_stlib_file_stream¶

consider_stlib_file_stream : bool = False

Whether streams based on stdio.h FILE streams should be considered.

reading_functions¶

reading_functions : set[bauhaus.analysis.config.QualifiedName] = {'fread', 'std::basic_istream::get', 'std::basic_istream::read', 'std::getline'}

Reading functions whose calls should not be followed by writing function calls without an intervening call to a resetting function call. operator>> is always considered as a reading function.

report_non_local_streams¶

report_non_local_streams : bool = False

If set to true, (possible) violations are reported for streams that are not local to routines and could thus be modified elsewhere.

resetting_functions¶

resetting_functions

Type: set[bauhaus.analysis.config.QualifiedName]

Default: {'fflush', 'fseek', 'fsetpos', 'rewind', 'std::basic_istream::seekg', 'std::basic_istream::tellg', 'std::basic_ostream::seekp', 'std::basic_ostream::tellp', 'std::basic_streambuf::pubseekoff', 'std::basic_streambuf::pubseekpos'}

Possible functions that reset the stream or file for subsequent reading or writing. Any reassignment to a stream or file counts as resetting.

writing_functions¶

writing_functions : set[bauhaus.analysis.config.QualifiedName] = {'fwrite', 'std::basic_ostream::put', 'std::basic_ostream::write'}

Writing functions whose calls should not be followed by reading function calls without an intervening call to a resetting function call. operator<< is always considered as a writing function.

Axivion Suite 7.12.0

Navigation