Undefined Behavior: File Pointer Dereference

The application uses an assignment that dereferences a system FILE object.

Depending on the specific C compiler in use, the address of a system FILE object might be significant to the use of the FILE object as a stream. Using a copy of the FILE object without the associated address can lead to undefined behavior resulting in potential system information leakage, a system crash, or the ability for a malicious actor to read or edit files at their discretion.

Example 1: The following code shows a system FILE object that is dereferenced and copied by value.

FILE *sysfile = fopen(test.file, "w+");
FILE insecureFile = *sysfile;

Because sysfile is dereferenced in the assignment of insecureFile, use of insecureFile can result in a wide variety of problems.