SEI CERT C Coding Standard

Input/Output (FIO) - FIO32-C. Do not perform operations on devices that are only appropriate for files
}
*/
if (0 == _stricmp(path, reserved[i])) {
ret = true;
}
}
return ret;
10.2.5 Risk Assessment
Allowing operations that are appropriate only for regular files to be performed on devices can result
in denial-of-service attacks or more serious exploits depending on the platform.
Rule Severity Likelihood Remediation Cost Priority Level
FIO32-C Medium Unlikely Medium P4 L3
10.2.6 Related Guidelines
CERT C Secure Coding Standard
FIO05-C. Identify files using multiple file attributes
FIO15-C. Ensure that file operations are performed
in a secure directory
POS01-C. Check for the existence of links
when dealing with files
POS35-C. Avoid race conditions while checking
for the existence of a symbolic link
CERT Oracle Secure Coding Standard for Java FIO00-J. Do not operate on files in shared directories
MITRE CWE
CWE-67, Improper Handling of Windows Device
Names
10.2.7 Bibliography
[Garfinkel 1996]
[Howard 2002]
[IEEE Std 1003.1:2013]
[MSDN]
Section 5.6, “Device Files”
Chapter 11, “Canonical Representation Issues”
XSH, System Interfaces, open
SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems 290
Software Engineering Institute | Carnegie Mellon University
[DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution.