TOCTOU Bug for open

[ArielSAdamsNASA]

Describe the bug
Calling function open that uses "EEPROM.DAT" after a check function. This can cause a time-of-check, time-of-use race condition.

Expected behavior
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. Could also use the O_CREAT and O_EXCL flags of POSIX's open() function.
https://cwe.mitre.org/data/definitions/367.html
https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files

Code snips

PSP/fsw/modules/eeprom_mmap_file/cfe_psp_eeprom_mmap_file.c

Lines 102 to 108 in 1bd7bd9

	FileDescriptor = open(EEPROM_FILE, O_RDWR);
	if (FileDescriptor == -1)
	{
	OS_printf("CFE_PSP: Cannot open EEPROM File: %s\n", EEPROM_FILE);
	perror("CFE_PSP: open");
	return (-1);
	}

System observed on:
Coverity: https://scan.coverity.com/projects/arielsadamsnasa-cfs-jsf-rules?tab=overview

Reporter Info
Ariel Adams, ASRC Federal

[skliper]

Could just open w/ O_CREAT, fstat to get the size and lseek/write if it's not EEPROMSize to get the same behavior as currently implemented.