The application creates a temporary file using an insecure mktemp function. This may lead to incorrect behavior or crash of the application.

The mktemp() function generates a unique temporary filename from template. The last six characters of template must be XXXXXX and these are replaced with a string that makes the filename unique. Since it will be modified, template must not be a string constant, but should be declared as a character array.

Never use mktemp(). Some implementations follow BSD 4.3 and replace XXXXXX by the current process ID and a single letter, so that at most 26 different names can be returned. Since on the one hand the names are easy to guess, and on the other hand there is a race between testing whether the name exists and opening the file, every use of mktemp() is a security risk.

C or C++ : File never closed

DerScanner Severity Score

Do you want to fix C or C++ : File never closed in your application?

See also