fix: check fclose() return value at all previously-flagged CFUSA-A007 sites - #119
Merged
Conversation
… sites Fixes every 'unchecked fclose() return value' (CERT-C ERR33-C) finding across the 9 files touched by today's ASIL-scaling/MC/DC work (cmd_qualify.c, cmd_safety_rules.c, cmd_coverage.c, test_impact.c, test_req_trace_cov.c, test_qualify_vv.c, test_coverage_asil.c, test_cli_commands.c, test_mcdc.c) -- 39 sites total. Product code (cmd_qualify.c's qt_write_file, cmd_safety_rules.c's comp001_file, cmd_coverage.c's parse_lcov) now genuinely handles a close failure: qt_write_file propagates it as a real error (its caller already checks for -1); the two file-walk callbacks log a diagnostic to stderr since their return value isn't otherwise surfaced by cfusa_walk_sources' callers. Test files use "if (fclose(f) != 0) TEST_FAIL_MESSAGE(...)" -- turning a silently-ignored close failure into an actual test failure, which is the correct semantic for test code (if closing a file we just wrote to fails, the test should fail, not continue as if nothing happened). This also genuinely satisfies CFUSA-A007's intent, unlike e.g. a bare (void)fclose(f) cast, which discards the value without checking it. Left the wider pre-existing ~130 unchecked-fclose sites elsewhere in the codebase (cmd_pr.c, cmd_release.c, cmd_tara.c, cmd_sign.c, and ~20 other test files never touched this session) out of scope -- a separate, much larger cleanup unrelated to today's work. Not a numbered issue -- fixed directly on request following a review of GitHub Advanced Security bot comments on today's merged PRs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
SoundMatt
added a commit
that referenced
this pull request
Aug 14, 2026
Covers three merged-but-unreleased PRs: #119 (unchecked fclose() fixes), #120 (CFUSA-A006 false-positive fix), #121 (CFUSA-L003 precision + ASIL-scaled severity). Also fixes two stale/inaccurate doc claims found while updating docs for this release: - docs/standards/misra-c.md and README.md both stated the check exit code reflects disposition acceptance. It doesn't -- cfusa check/lint never read .fusa-dispositions.json (issue #122). Corrected both to state this plainly instead of overclaiming. - README.md named the dispositions file .cfusa-dispositions.json -- that's the legacy fallback read path; the file cfusa disposition add actually writes is .fusa-dispositions.json. docs/standards/iso26262.md's "What scales by ASIL today" list gains an entry for CFUSA-L003's new ASIL-scaled severity (PR #121). Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes every "unchecked fclose() return value" (CERT-C ERR33-C,
CFUSA-A007) finding flagged by GitHub Advanced Security across the 9 files touched by today's ASIL-scaling/MC/DC work — 39 sites total.What changed
Product code now genuinely handles a close failure:
cmd_qualify.c'sqt_write_file()propagates it as a real-1error (its caller already checks for that).cmd_safety_rules.c'scomp001_file()andcmd_coverage.c'sparse_lcov()log a diagnostic to stderr, since their return value isn't otherwise surfaced bycfusa_walk_sources()'s callers.Test files use
if (fclose(f) != 0) TEST_FAIL_MESSAGE(...)— turning a silently-ignored close failure into an actual test failure, the correct semantic for test code (if closing a file we just wrote to fails, the test should fail, not continue as if nothing happened). This also genuinely satisfies the rule's intent, unlike a bare(void)fclose(f)cast which discards the value without checking it.Scope
Left the wider pre-existing ~130 unchecked-
fclose()sites elsewhere in the codebase (cmd_pr.c,cmd_release.c,cmd_tara.c,cmd_sign.c, and ~20 other test files never touched this session) out of scope — a separate, much larger cleanup unrelated to today's work.Not a numbered issue — fixed directly on request following a review of GitHub Advanced Security bot comments on today's merged PRs.
Testing
ctest: 42/42 passing.cfusa check --dir .: 0 errors (warning count dropped from 1299 to 1260, matching the 39 fixes).cfusa analyze --dir .: zero remainingCFUSA-A007/fclosefindings in all 9 targeted files, confirmed via a fresh re-scan.🤖 Generated with Claude Code