CERT
Skip to end of metadata
Go to start of metadata

A call to the fopen() or freopen() function must be matched with a call to fclose() before the lifetime of the last pointer that stores the return value of the call has ended or before normal program termination, whichever occurs first.

In general, this rule should also be applied to other functions with open and close resources, such as the POSIX open() and close() functions, or the Microsoft Windows CreateFile() and CloseHandle() functions.

Noncompliant Code Example

This code example is noncompliant because the file opened by the call to fopen() is not closed before function func() returns:

Compliant Solution

In this compliant solution, the file pointed to by f is closed before returning to the caller:

Noncompliant Code Example (exit())

This code example is noncompliant because the resource allocated by the call to fopen() is not closed before the program terminates.  Although exit() closes the file, the program has no way of determining if an error occurs while flushing or closing the file.

Compliant Solution (exit())

In this compliant solution, the program closes f explicitly before calling exit(), allowing any error that occurs when flushing or closing the file to be handled appropriately:

Noncompliant Code Example (POSIX)

This code example is noncompliant because the resource allocated by the call to open() is not closed before function func() returns:

Compliant Solution (POSIX)

In this compliant solution, fd is closed before returning to the caller:

Noncompliant Code Example (Windows)

In this noncompliant code example, the file opened by the Microsoft Windows CreateFile() function is not closed before func() returns:

Compliant Solution (Windows)

In this compliant solution, hFile is closed by invoking the CloseHandle() function before returning to the caller:

Risk Assessment

Failing to properly close files may allow an attacker to exhaust system resources and can increase the risk that data written into in-memory file buffers will not be flushed in the event of abnormal program termination.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

FIO42-C

Medium

Unlikely

Medium

P4

L3

Automated Detection

This rule is stricter than rule [fileclose] in ISO/IEC TS 17961:2013. Analyzers that conform to the technical standard may not detect all violations of this rule.

Tool

Version

Checker

Description

CodeSonar4.4ALLOC.LEAKLeak
Compass/ROSE   
Coverity2017.07

RESOURCE_LEAK (partial)

Partially implemented
Klocwork2017

RH.LEAK

 
LDRA tool suite9.5.6

49 D

Partially implemented
Parasoft C/C++test9.5BD-RES-LEAKS 
Polyspace Bug FinderR2016aResource leak

File stream not closed before FILE pointer scope ends or pointer is reassigned

SonarQube C/C++ Plugin

3.11

S2095 

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

[IEEE Std 1003.1:2013]XSH, System Interfaces, open