On Thursday 31 of December 2009 00:09:40 Björn Stenberg wrote:
> fopen(3) cannot open a file for writing and fail if it exists, only open(2)
> can do that. Hence a separate check call is necessary if we want this
> feature to not overwrite existing files. I think that is a nice safety
> catch.

Sorry, I didn't realize that. But I don't think it's "nice" anyway :-)

The file may be created right after your check. And yes ... I know it's not
so probable in the cURL tool, but a proper solution does not seem to be
more complex than the current one.

What about the fdopen(), POSIX compliant solution from here?

https://www.securecoding.cert.org/confluence/display/seccode/FIO03-C.+Do+not+make+assumptions+about+fopen()+and+file+creation

Kamil
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-users
FAQ: http://curl.haxx.se/docs/faq.html
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2009-12-31