Open
Description
Time-of-check to time-of-use (aka “TOCTTOU”, “TOCTOU”, or “TOC/TOU”) is a class of race condition bugs that can be observed in almost any language. Some basic examples in Go would be:
// BAD: Checks if the file is there before opening it instead of catching
// os.ErrNotExist with errors.Is. File may be deleted between the call to
// os.Stat and the call to os.Open.
_, err = os.Stat(fileName)
if err == nil {
f, err = os.Open(fileName)
if err == nil
65EF
{
fatal()
}
}And:
// BAD: lockedX could change between the first mu.Unlock() and the second
// mu.Lock(). Either lock the whole method or use the atomic.CompareAndSwap*
// family of functions.
var x int
mu.Lock()
x = lockedX
mu.Unlock()
if x == 0 {
mu.Lock()
lockedX = newX
mu.Unlock()
}Detecting such bugs in general is probably an impossible task (although there seems to have been some work put into it), but I think that these two patterns could be detected reliably at least within one function.