CERT C: Rec. FIO13-C

R2026b

Never push back anything other than one read character

Since R2026b

Description

Never push back anything other than one read character¹

Polyspace Implementation

Polyspace checks for the issue Consecutive Pushback Without Stream Reset.

Examples

Consecutive Pushback Without Stream Reset

Issue

The issue occurs when ungetc() or ungetwc() is called twice on the same stream without an intervening read or stream-positioning operation between the two calls.

Operations that reset the stream between pushback calls include:

• Read operation — fgetc(), fgets(), fgetwc(), fread(), fscanf(), getc(), getchar(), getwc(), getwchar(), gets(), gets_s()

• Stream positioning operation — fseek(), fsetpos(), rewind()

Write operations (fwrite(), fprintf(), fputc(), putc(), fputs()) do not count as a reset.

Risk

The C Standard guarantees only one character of pushback per stream. A second ungetc() call without an intervening read or stream-positioning operation is undefined behavior. If your code pushes back twice in the same stream, the internal one-byte pushback slot can be overwritten and the next read from the stream can return unpredictable values. Programs that parse input by pushing back lookahead characters can misinterpret tokens, skip data, or enter infinite loops when your code pushes back into a stream consecutively without an intervening read or stream-positioning operation.

Fix

Perform a read operation or a stream positioning operation on the stream between calls to ungetc() or ungetwc(). If multiple characters need to be pushed back, use fgetpos() and fsetpos() to save and restore the stream position instead of multiple ungetc() calls.

Example — Multiple Pushback on File Stream

In this example, ungetc() is called twice on the same file stream without an intervening read or stream-positioning operation.

#include <stdio.h>

void read_header(const char *filename) {
    FILE *fp = fopen(filename, "rb");
    if (fp != NULL) {
        ungetc('\n', fp);
        ungetc('\r', fp);    // Noncompliant
        fclose(fp);
    }
}

The second call to ungetc() pushes back a character onto a stream that already has an unread pushed-back character. This results in undefined behavior.

Correction — Use Stream Positioning Between Pushback Calls

Reset the stream position using fseek() before the second ungetc() call.

#include <stdio.h>

void read_header(const char *filename) {
    FILE *fp = fopen(filename, "rb");
    if (fp != NULL) {
        ungetc('\n', fp);
        fseek(fp, 0, SEEK_SET);    // Compliant
        ungetc('\r', fp);           // Compliant
        fclose(fp);
    }
}

Check Information

Group: Rec. 09. Input Output (FIO)

PQL Name: std.cert.FIO13_C

Version History

Introduced in R2026b