CERT C: Rec. FIO09-C

R2026b

Be careful with binary data when transferring data across systems

Since R2026b

Description

Be careful with binary data when transferring data across systems¹

Polyspace Implementation

Polyspace^® checks for the issue Dangerous binary data transfer.

Examples

Dangerous binary data transfer

Issue

The issue occurs when fread() or fwrite() operates on types other than char and char*.

Risk

Binary data representations can differ across systems because of endianness, structure padding, and type sizes. Using fread() or fwrite(), which reads or writes the binary representation, makes your code less portable. Code that behaves correctly in one system may not behave the same in another system.

Fix

Serialize data to a text-based or platform-independent format before writing. When reading, parse text representations and convert to the appropriate types. Alternatively, use a serialization library that handles byte-order and alignment differences.

Example — Binary Read of Structure with fread

In this example, Polyspace reports a violation on the fread() call that reads binary data into an aggregate structure.

#include <stdio.h>
#include <stdlib.h>

struct SensorData {
    char id;
    long reading;
};

void read_sensor_data(FILE *stream) {
    struct SensorData data;
    fread(&data, sizeof(struct SensorData), 1, stream); // Noncompliant
}

The binary representation of the aggregate structure SensorData can be different across systems. Reading it with fread() makes the code nonportable. Polyspace reports a violation.

Correction — Use Text-Based Parsing

Read data as text and convert each field to the appropriate type.

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>

struct SensorData {
    char id;
    long reading;
};

void read_sensor_data(FILE *stream) {
    struct SensorData data;
    char buf[64];
    char *end_ptr;

    if (fgets(buf, sizeof(buf), stream) == NULL) { // Compliant
        return;
    }
    data.id = buf[0];

    if (fgets(buf, sizeof(buf), stream) == NULL) { // Compliant
        return;
    }
    data.reading = strtol(buf, &end_ptr, 10);
    if ((errno == ERANGE) || (end_ptr == buf)) {
        return;
    }
}

Check Information

Group: Rec. 09. Input Output (FIO)

PQL Name: std.cert.FIO09_C

Version History

Introduced in R2026b