Using fseek and ftell to determine the size of a file has a vulnerability?
问题 I've read posts that show how to use fseek and ftell to determine the size of a file. FILE *fp; long file_size; char *buffer; fp = fopen("foo.bin", "r"); if (NULL == fp) { /* Handle Error */ } if (fseek(fp, 0 , SEEK_END) != 0) { /* Handle Error */ } file_size = ftell(fp); buffer = (char*)malloc(file_size); if (NULL == buffer){ /* handle error */ } I was about to use this technique but then I ran into this link that describes a potential vulnerability. The link recommends using fstat instead.