title: Using fseek and ftell to determine the size of a file has a vulnerability?
body: <p>I've read posts that show how to use fseek and ftell to determine the size of a file. </p>
  
  <pre><code>FILE *fp;
  long file_size;
  char *buffer;
  
  fp = fopen("foo.bin", "r");
  if (NULL == fp) {
   /* Handle Error */
  }
  
  if (fseek(fp, 0 , SEEK_END) != 0) {
    /* Handle Error */
  }
  
  file_size = ftell(fp);
  buffer = (char*)malloc(file_size);
  if (NULL == buffer){
    /* handle error */
  }
  </code></pre>
  
  <p>I was about to use this technique but then I ran into this <a href="https://www.securecoding.cert.org/confluence/display/seccode/FIO19-C.+Do+not+use+fseek%28%29+and+ftell%28%29+to+compute+the+size+of+a+file" rel="noreferrer">link</a> that describes a potential vulnerability. </p>
  
  <p>The link recommends using fstat instead. Can anyone comment on this?</p>