Best Practices for Secure Programming

System Calls

• ALWAYS ALWAYS ALWAYS check the return value of your system calls!!!

              fp = fopen("/tmp/foo", "w");
              fprintf(fp, "this is a line\n");
  
              /* I'm done, but I don't feel like closing the file */
              while (1) { duhhh; }
          
  
       NOOOO!!! DO THIS 
  
          
              if ((fp = fopen("/tmp/foo", "w")) == NULL) { 
  
                  perror("fopen");
                  syslog(LOG_ERR, "fopen: %m");
  
                  if (fprintf(errfp, "fopen: %s", strerror(errno)) < 0) { 
                      syslog(LOG_ERR, "fprintf: can't write to errfp\n");
                  }
  
                  returnorexitorsomething();
              }
  
              if (fprintf(fp, "this is a line\n") < 0) { 
  
                  perror("fopen");
                  syslog(LOG_ERR, "fopen: %m");
  
                  if (fprintf(errfp, "fopen: %s", strerror(errno)) < 0) { 
                      syslog(LOG_ERR, "fprintf: can't write to errfp\n");
                  }
                  returnorexitorsomething();
              }
  
              if (fclose(fp) < 0) { 
                  perror("fopen");
                  syslog(LOG_ERR, "fopen: %m");
  
                  if (fprintf(errfp, "fopen: %s", strerror(errno)) < 0) { 
                      syslog(LOG_ERR, "fprintf: can't write to errfp\n");
                  }
                  returnorexitorsomething();
              }