File Input and Output in C

A file is stored data; a stream is the channel a running program uses to reach it. The same stream functions can also work with a terminal or pipe. Include <stdio.h> and keep the stream pointer in a variable of type FILE *.

What the stream remembers

The library's FILE object tracks a buffer, the current file position, and end-of-file and error indicators. Pass its pointer to functions such as fgetc and fprintf; do not inspect or change its fields. A read or write advances the position past the data processed. In a binary file beginning with "hello\nworld\n", reading the first six bytes leaves the next read at the w.

Buffering groups small operations into larger transfers. A successful write can mean that data reached a memory buffer, with the operating-system transfer still pending. fflush(fp) sends pending output to the operating system. fclose(fp) does that before releasing the stream. Neither is a promise that data will survive a sudden power loss.

Ordinary files opened with fopen are fully buffered. Interactive devices can use different buffering. A terminal or pipe does not provide ordinary file positions for jumping backward and forward.

Choose text or binary mode

Text mode handles human-readable lines. Binary mode preserves byte values without text translations. Add b to the opening mode for binary data: "rb" reads it and "wb" writes it. Images, compressed data, and raw records need binary mode even if a text-mode version appears to work on your own computer.

On Linux and macOS, a newline is one LF byte, 0x0A, and the two modes normally behave alike. On Windows, text output translates '\n' into the two bytes CR LF, 0x0D 0x0A. Text input translates CR LF back into one '\n'. Microsoft's text input also recognizes 0x1A, Ctrl+Z, as end of file.

For example, writing "a\nb\nc\n" in text mode produces six bytes on Linux or macOS and nine on Windows. Three letters contribute three bytes; three Windows line endings contribute six. Reading the Windows file in text mode on Windows gives six characters, while binary mode exposes all nine bytes.

Keep the file's bytes separate from its text

A Windows-created line read on Linux may retain "\r\n". Removing only '\n' leaves '\r', which can make a comparison with "yes" fail. A text-stream position can also reflect translation state, so save and restore text positions instead of calculating byte offsets.

C's exact text round-trip guarantee applies to printable characters, tabs, and newlines, with no space immediately before a newline and a newline ending the last line. Other byte sequences belong in binary streams. C bytes have at least eight bits; examples involving 0–255 byte values and common file formats use eight-bit bytes.

Choose an opening mode before you write any processing code. The mode controls whether the file must exist, whether its contents survive, and where writes go. fopen acts on the file immediately: a successful "w" open erases an existing file even if no later write occurs.

Match the mode to the task

Add b for binary mode; "r+b" and "rb+" mean the same thing. C11 adds exclusive creation with x in write modes, such as "wx" and "wbx": opening fails if the file exists. Use a documented mode string; extra mode letters are not portable.

Check before using the pointer

fopen returns a new stream pointer on success and NULL on failure. Missing files, inaccessible paths, and missing directories can all cause failure.

FILE *fp = fopen("scores.txt", "r");
if (fp == NULL) {
    fprintf(stderr, "Cannot open scores.txt\n");
    return EXIT_FAILURE;
}
/* Read through fp here. */
if (fclose(fp) == EOF) {
    fprintf(stderr, "Cannot close scores.txt\n");
    return EXIT_FAILURE;
}

The snippet uses <stdio.h> and <stdlib.h>. Functions such as fgetc, fprintf, and fclose need a valid stream; passing NULL is undefined behavior. fflush(NULL) is a deliberate exception that flushes all output streams.

fclose returns 0 on success and EOF on failure. Once called, the stream is finished, including when closing reports an error. Do not retry fclose on the same pointer or use it for further I/O. Close files promptly: available streams are limited, and C guarantees support for at least eight open streams, including the three standard ones.

Resolve paths from the running program

A relative path such as "data/input.txt" starts at the current working directory, not the source file's folder. Starting the program elsewhere changes what that path names. Forward slashes also work with Microsoft's C library. A backslash in a C string must be doubled, as in "C:\\data\\in.txt"; otherwise an escape such as \n can change the string.

For names supplied on the command line, use int main(int argc, char *argv[]). In a two-name copy command, argc must be 3, argv[1] is the input name, and argv[2] is the output name. Open input first so a misspelled input name does not create or erase output. If output opening fails, close the already-open input. Use distinct input and output files: opening the input first does not protect it if the output name identifies that same file.

Normal return from main or exit closes streams, but explicit closes let the program detect delayed output errors. A crash can lose buffered data; abort does not provide the normal-exit cleanup guarantee.

A C program starts with three open streams: standard input stdin, standard output stdout, and standard error stderr. They usually connect to the terminal, but the shell can connect them to files or other programs. You can pass them directly to stream functions.

Keep results separate from diagnostics

printf writes to stdout; scanf reads from stdin. getchar() reads a character from stdin, and putchar(c) writes one to stdout. puts(s) writes a string to stdout and adds a newline. Their stream forms let the same code work with a file:

void print_total(FILE *out, int total)
{
    fprintf(out, "Total: %d\n", total);
}

Calling print_total(stdout, 12) prints a result; passing an opened file pointer directs the same layout to a file. In production code, make the helper report a failed write to its caller.

Write diagnostics with fprintf(stderr, ...). A data-processing program can then produce a clean result file while explaining failures separately. An error printed to stdout can corrupt the data another program expects to read.

Let the shell choose connections

In a Unix-like shell, this command separates all three streams:

./sortnums < numbers.txt > sorted.txt 2> errors.txt

< supplies input, > creates or replaces output, >> appends output, and 2> redirects errors. The redirection operators also work in Windows Command Prompt, where the program name is commonly written as sortnums.exe. A pipe, as in generate | sortnums, sends the first program's standard output to the second program's standard input. It does not carry stderr by default.

A filter can accept an optional input name and otherwise read stdin. Keep track of ownership: close a stream your function opened, but leave a borrowed stream for its owner. For a simple command-line filter, if (in != stdin) identifies the file it opened itself.

Flush prompts before waiting for input

A terminal commonly makes stdout line buffered. A redirected file or pipe commonly makes it fully buffered. stderr is not fully buffered. This explains why output order can change when both streams are sent to one destination.

After printf("Saving..."), the text can remain in the buffer because there is no newline. Use fflush(stdout) and check for EOF when it must appear before the next operation. Flushing sends pending output; it does not read or discard input. Standard C does not define fflush(stdin) as an input-clearing operation. To discard a line, read characters until '\n' or EOF.

If a program prints two lines to stdout and a warning to stderr between them, a terminal will commonly show program order. With > out.txt 2>&1, the warning can reach the file before buffered standard output. Do not use mixed-stream display order as a record of execution order.

Return a usable result to scripts

Return EXIT_SUCCESS or 0 when the complete job succeeds and EXIT_FAILURE when it fails. Both macros are declared in <stdlib.h>. A shell command such as convert in.csv out.txt && echo done runs the second command only after success. An honest exit status matters as much as a useful diagnostic.

Character I/O is useful when each character determines what happens next: counting separators, changing case, or recognizing a small text format. fgetc reads one character, and fputc writes one. Both are declared in <stdio.h>.

Keep the return value in an int

fgetc(fp) returns the character as an unsigned char converted to int, or the negative constant EOF when no character is available because input ended or a read failed. On the usual eight-bit-byte systems, valid byte values run from 0 to 255. An int keeps those values separate from EOF.

int c;
while ((c = fgetc(in)) != EOF) {
    if (fputc(c, out) == EOF) {
        /* Report a write failure and clean up. */
        break;
    }
}
/* Check ferror(in) before declaring the input complete. */

A plain char can lose this distinction. With signed char, byte 0xFF can become -1 and look like end of file. With unsigned char, the negative EOF value is converted to a byte and can never compare equal to EOF.

Keep both parentheses around the assignment. In c = fgetc(in) != EOF, comparison happens first, so c receives 1 or 0 instead of the character. getc does the same reading job and may be a macro; fputc returns the written character or EOF.

Count successful reads, not attempts

The loop condition must perform the read. feof describes an earlier attempt that reached the end; it cannot predict the next attempt. A loop that checks !feof(in) and then counts unconditionally adds an extra pass at the end.

For the text "hi\nyo\n", six successful reads give six characters and two newline characters. Counting newline characters alone works for newline-terminated lines. The text "red\ngreen\nblue" has two newlines but three lines because the final "blue" is still a line.

To include a final line without a newline, track the last character as well:

size_t lines = 0;
int c, last = '\n';
while ((c = fgetc(in)) != EOF) {
    if (c == '\n') ++lines;
    last = c;
}
if (last != '\n') ++lines;

Starting last at '\n' makes an empty file count as zero lines. A read error still requires a separate failure path; a partial count is not a completed result.

Transform or look ahead

toupper from <ctype.h> can change letters before writing them. A successful fgetc result is already in the valid input range for toupper, so fputc(toupper(c), out) is safe inside the loop. Arbitrary signed char values need conversion to unsigned char before character-classification functions.

ungetc(c, in) pushes a character back so that the next read returns it again. One character of pushback is guaranteed; check for EOF if pushing back fails. This helps a parser inspect the next character without losing it. A positioning operation discards pushback.

The count describes what the selected stream mode delivers. On Windows, text mode counts a CR LF pair as one '\n'; binary mode exposes both bytes. A character count through a text stream therefore need not equal the stored byte count.

Formatted I/O converts between C values and readable text. fprintf writes a layout you choose; fscanf reads values that match a format. Their conversion specifications look similar, but input requires pointers to the right destination types.

Write readable values

Use %d for an int, %ld for a long, %zu for a size_t, %s for a string, and %c for a character. Output %f prints a double; a float argument is promoted to double. %% prints a percent sign.

int result = fprintf(fp, "%-8s%6.2f\n", "Oslo", 3.14159);
if (result < 0) {
    /* Handle a write failure. */
}

%-8s left-aligns "Oslo" in eight columns; %6.2f right-aligns "3.14" in six. The resulting line is "Oslo 3.14\n", and the return is 15 characters. Field width is a minimum, not an output length limit. Precision also changes stored information: %.2f writes 3.14159 as "3.14", so those extra digits cannot be recovered from the file.

A simple CSV writer can output "Lima,2024,19.5" with a fixed order and commas between fields. Text containing commas, quotation marks, or newlines needs CSV quoting. Enclose such a field in double quotes, and double any quotation mark inside it. A bare %s writer is suitable only when text fields do not contain those characters.

Format into a bounded array

sprintf has no destination-size argument. Formatting "007.jpg" needs eight bytes including the null terminator. Prefer snprintf:

char name[32];
int n = snprintf(name, sizeof name, "%03d.jpg", 7);
if (n < 0 || (size_t)n >= sizeof name) {
    /* Formatting failed or the full result did not fit. */
}

The nonnegative return is the length the complete text would need, excluding the null terminator. Equality with the buffer size already means truncation. Check negativity before converting the result to size_t.

Read the expected number of values

char name[20];
int age;
int matched = fscanf(fp, "%19s %d", name, &age);

This call succeeds completely only if it returns 2. The width 19 leaves a byte for the terminator. The array name supplies its address; the integer needs &age. For input, %f needs float *, while %lf needs double *. A mismatch is undefined behavior, not a harmless conversion.

Most conversions skip leading whitespace, including newlines. fscanf therefore does not enforce one record per line, and %s cannot read "New York" as a single value. A scan set such as %19[^,] reads up to a comma; whole-line input is often clearer for records.

On "10 abc 20", %d first stores 10 and returns 1. The next call returns 0 because "abc" does not match; that text remains unread. Testing != EOF repeats the failure forever. Test == 1, then handle invalid data separately from end of input or a stream error. A conversion result is a count of assigned values, not a truth value for the entire file.

Reading a complete line before parsing it keeps each text record separate. If a record is invalid, you can report its line number and continue with the next one. fgets limits how much it writes, but you must still handle retained newlines and lines larger than the array.

Read into a known capacity

char line[256];
while (fgets(line, sizeof line, fp) != NULL) {
    /* Process this successful read. */
}
if (ferror(fp)) {
    /* Report an interrupted read. */
}

fgets reads at most one less than the capacity, stops after a newline if it encounters one, and adds a null terminator. It returns the buffer on success. A NULL result means either that no characters were available at end of file or that an error occurred; do not process the buffer after a read error.

sizeof line supplies the array capacity in this scope. In a helper whose parameter is char *line, it is the pointer's size. Pass the actual capacity separately. The old gets function cannot limit input and was removed in C11.

Recognize pieces of long lines

With char buf[8], "temperature\n" arrives as "tempera" and then "ture\n". The first call uses seven bytes for characters and one for the terminator. A successful read without a newline might be a piece of a long line or the final unterminated piece at end of file.

Choose a policy: join pieces into a larger record, process them as a continuous sequence, or reject the record and discard all of its remaining pieces. For a size limit, inspect the next character before rejecting an exactly full buffer. A next newline completes the record; EOF without a stream error completes an unterminated final line; another character means more content. Push back a character only if later code needs to read it again.

Remove only an ending you actually found

After deciding whether the record is complete, remove line endings:

line[strcspn(line, "\r\n")] = '\0';

strcspn from <string.h> finds the first listed character, or the existing terminator if neither occurs. This handles retained CR LF as well as LF. Deleting line[strlen(line) - 1] unconditionally can remove real data from a final line without a newline, and it is invalid for an empty string.

fputs(line, out) writes the string without adding a newline; puts(line) writes to stdout and adds one. A text copy can pass each successful fgets piece to fputs, checking for failure, even when a long line spans several pieces. For exact original bytes, use binary block I/O instead.

Parse and validate separately

sscanf(line, "%d %9s", &qty, item) returns 2 for "7 apples" and 0 for "seven apples". A failed parse leaves no bad token stuck in the input stream because the line was already read. Numeric conversions with sscanf still require representable input; use strtol for strict range checking.

For strtol, clear errno, pass an end pointer, and check for no digits, ERANGE, and unexpected trailing text. On "42abc", the result 42 is only a numeric prefix. For a whole-number field, allow the chosen trailing whitespace, then require the end of the string. Check the destination type's range before narrowing a valid long to int.

Binary I/O transfers the bytes of objects without converting them to readable numbers or words. fread and fwrite take an address, an element size, an element count, and a stream. Their return values count complete elements, so choosing the element size determines what you can learn from the result.

Write and read arrays

int a[5] = {1, 2, 3, 4, 5};
if (fwrite(a, sizeof a[0], 5, out) != 5) {
    /* Handle a write failure. */
}

On a system with four-byte int, this writes 20 bytes and returns 5. Reading into another five-element array with the same representation can recover the values. Use "wb" and "rb" so text translations cannot alter the bytes.

For a single object, pass its address: fwrite(&rec, sizeof rec, 1, out). For objects reached through a pointer p, use fwrite(p, sizeof *p, count, out). sizeof p measures the pointer, and &p points at the pointer variable itself. Neither expresses the intended data transfer. When element size or count is zero, both functions return zero without transferring data.

Copy exactly the bytes read

unsigned char buf[512];
size_t n;
while ((n = fread(buf, 1, sizeof buf, in)) > 0) {
    if (fwrite(buf, 1, n, out) != n) {
        /* Handle failure and stop copying. */
        break;
    }
}

An element size of 1 makes n a byte count. A 1300-byte input supplies 512, 512, and 276 bytes, then zero. The last write must use 276, not the capacity 512. Writing the whole buffer adds 236 bytes left over from earlier reads.

With fread(buf, 512, 1, in), the same input returns 1, 1, then 0. The final 276 bytes are only a partial element; they are not counted, and that partial element's value is indeterminate. Choose byte elements when a partial final block is useful. Choose record-sized elements when incomplete records must be rejected.

A short fread can mean end of file or an error. Check ferror after copying and check fclose on output: a write accepted into a buffer can fail later. A partial header or record must never be treated as a complete object.

Inspect signatures and stored objects

Use unsigned char for raw bytes; on eight-bit-byte systems it holds 0–255 without negative values. JPEG data begins with 0xFF 0xD8. Camera and phone photos often continue with an APPn marker, producing the recovery pattern FF D8 FF E0 through FF D8 FF EF. That pattern is a useful candidate test; validate the format before trusting it. Some JPEGs use a different next segment.

A struct with char name[20] and an int score commonly occupies 24 bytes. A raw write includes all its stored bytes, including padding. A pointer member saves an address, not the pointed-to string. Use an embedded array or write the string's length and characters separately.

Readable text can take more space: "1000000\n" uses eight bytes on Linux and nine in Windows text mode. An explicitly encoded 32-bit integer uses four eight-bit bytes. Raw object storage is compact but ties the file to the producer's representation.

A binary stream preserves bytes, but two machines can interpret the same bytes differently. A portable format defines what each byte means instead of adopting whatever layout the compiler gives an object.

Specify sizes, order, and layout

Three choices make a raw object dump machine-dependent:

Little-endian stores the least significant byte first. Big-endian stores the most significant byte first. The value 258, hexadecimal 0x00000102, is 02 01 00 00 in little-endian order and 00 00 01 02 in big-endian order.

A common struct layout for a char followed by an int occupies eight bytes: one byte for the character, three padding bytes, and four for the integer. Padding values are unspecified. Exact-width types from <stdint.h>, such as uint32_t, fix bit widths where provided; they do not fix byte order or remove padding. Common file-format examples assume eight-bit bytes and the availability of those types.

Decode fields explicitly

Read four bytes completely before interpreting them. For a little-endian field:

uint32_t v = (uint32_t)b[0]
           | (uint32_t)b[1] << 8
           | (uint32_t)b[2] << 16
           | (uint32_t)b[3] << 24;

Here b is an unsigned-byte array. Each cast takes place before the shift, so the arithmetic has the required unsigned width. To encode, extract the low eight bits, then the next eight, and so on. Check every output operation. Writing v directly with fwrite would put the host's byte order back into the format.

Define a complete small format

A scores format can use "SCR1" as a four-byte signature, a four-byte little-endian count, and records made of 20 name bytes plus four little-endian score bytes. The signature also identifies the version. The header is eight bytes; each record is exactly 24 bytes.

Five records occupy 128 bytes. Record index 3 begins at byte 80: skip eight header bytes and three complete records. State the name-field encoding and termination or padding policy as part of a real format; a fixed 20-byte name field is not automatically a C string.

Check a header's complete length and signature before using its fields. Then check counts and lengths against reasonable limits and the available data before allocating memory. A plausible count is not enough if later records are missing.

Read the actual format structure

Some PCM WAV files have a simple 44-byte header, with the sample rate at bytes 24–27. Bytes 44 AC 00 00 decode to 44100 samples per second. Other WAV files contain extra chunks, so a general reader follows chunk identifiers and sizes to locate the fmt chunk. Assuming one fixed header layout for every file can read an unrelated field as the rate.

Text such as CSV avoids integer-size, byte-order, and struct-padding problems and is easy to inspect. It still needs a defined field layout, quoting rules, and checked parsing. Choose it when readability and interchange matter more than compact binary representation.

Sequential reads visit data in order. Random access lets a program jump to a known location, such as one record in a large file. Positioning works only when the underlying stream supports it, and the meaning of a position differs between binary and text streams.

Tell and seek

ftell(fp) returns a long position or -1L on failure. For a binary file, a position counts bytes from its start. fseek(fp, offset, whence) moves relative to a selected reference point and returns 0 on success, nonzero on failure.

For example, fseek(fp, -4L, SEEK_END) requests the last four bytes of a binary file on a system supporting end-relative seeks. Check the result before reading. A request on a pipe or terminal, or a request before the start of an ordinary file, can fail.

Calculate a record location

For headerless fixed-size binary records, the zero-based index multiplied by the record width gives the starting offset. With 24-byte records, index 3 starts at byte 72. After reading that entire record, the position is 96.

long offset = 3L * (long)sizeof(struct record);
if (fseek(fp, offset, SEEK_SET) != 0) {
    /* Handle the failed move before reading. */
}

This example assumes the file was written with the same struct layout. A specified portable format uses its defined record width instead. Include header bytes when present. The third record counted from 1 is index 2, not index 3. For large indexes, validate the multiplication and ensure the result fits long before seeking.

On mainstream systems, seeking to the end and using ftell can measure a binary file: a 120-byte file with 24-byte records holds five records. Check both calls and restore the position afterward. Standard C does not require a meaningful SEEK_END for every binary stream, so the method depends on that stream's support.

Save text positions without arithmetic

Text mode can translate line endings. A returned text position is information for getting back to a place, not a count to add or subtract. A nonzero text seek uses a value previously returned by ftell for the same file, with SEEK_SET. A zero offset is permitted with any reference point.

rewind(fp) returns to the start and clears both end-of-file and error indicators. It returns no result, so use checked fseek(fp, 0L, SEEK_SET) when moving successfully must be confirmed. A successful fseek clears end of file and discards ungetc pushback, but leaves an existing error indicator set.

Keep a position token

fgetpos(fp, &pos) saves a position in fpos_t; fsetpos(fp, &pos) restores it. Check both for nonzero failure. Treat fpos_t as an opaque token, with no arithmetic. It can hold position information beyond a simple byte count.

fseek and ftell use long, which is commonly 32 bits on Windows and limits representable positions to about 2 GiB. A position token avoids tying the interface to long, but the supported file size still depends on the implementation and configuration.

An update stream reads and writes the same file. Use "r+b" to preserve an existing binary file while changing its records. "w+b" erases the old file immediately, and append modes force every write to the end.

Make direction changes valid

An update stream has two switching rules:

Positioning functions include fseek, fsetpos, and rewind. Check functions that report a result before continuing. A direction change without the required action has undefined behavior; you cannot predict that it will merely affect the next record.

Update one complete record

Suppose a headerless file contains five 24-byte records in the same representation as struct record. To change index 3:

1. Open with "r+b" and check the pointer.
2. Seek to byte 72 and check success.
3. Read exactly one complete record.
4. Change its score member to 99.
5. Seek back to the record's start.
6. Write exactly one record and check the close result.

The key middle operations are:

if (fread(&rec, sizeof rec, 1, fp) != 1) {
    /* Report the incomplete input, then clean up. */
    goto cleanup;
}
rec.score = 99;
if (fseek(fp, -(long)sizeof rec, SEEK_CUR) != 0) {
    /* Report the failed seek, then clean up. */
    goto cleanup;
}
if (fwrite(&rec, sizeof rec, 1, fp) != 1) {
    /* Report the failed write, then clean up. */
    goto cleanup;
}

The enclosing function supplies a cleanup label that closes its stream and returns failure on these branches. After the read, the position is 96. Moving back 24 bytes both selects the original record and permits the read-to-write switch. A successful replacement leaves the file at 120 bytes with five records. Restoring a saved start position is another valid way to perform the update.

Decide when to rewrite

Appending a 24-byte record grows that file to 144 bytes. Seeking to the beginning of an "ab" or "a+b" stream cannot turn its next write into an overwrite; the write still goes to the current end.

An in-place replacement must fit the space it replaces. Changing "Bo,7" to "Bo,9" fits. Writing "Bo,12" over "Bo,7\n" consumes the newline and joins the following text onto the record. To grow or shrink records, write a corrected new file. Standard C has no stream function that removes a range of bytes from the middle of a file. Deletion can instead copy all surviving records or mark a fixed-size record as deleted.

Keep replacement recoverable

Check remove and rename; both return 0 on success. Whether rename replaces an existing destination is implementation-defined. Linux and macOS support replacement; Microsoft's C library fails when the destination exists.

A portable recovery plan writes and closes the new file, renames the original to a distinct backup name, and renames the new file to the original name. If installation fails, keep the backup available for restoration and report where it is. Delete the backup only after installation succeeds. This sequence supports recovery; it is not a portable atomic transaction or a guarantee against power failure.

A file can open successfully and still fail during reading, writing, seeking, or closing. A robust program checks the result of the operation it actually attempted. It distinguishes a completed read from interrupted input and distinguishes malformed data from a failing stream.

Learn each failure signal

rewind, clearerr, and perror return no value. If successful movement to the start must be checked, use fseek instead of relying on a result from rewind.

Inspect the stream after a read stops

The stream keeps separate end-of-file and error indicators. feof(fp) tests the first; ferror(fp) tests the second. Each returns nonzero if its indicator is set.

while (fgets(line, sizeof line, fp) != NULL) {
    /* Process successful input. */
}
if (ferror(fp)) {
    fprintf(stderr, "Input could not be completed\n");
    /* Return failure after cleanup. */
}

The return from fgets alone does not distinguish the two stopping reasons. Similarly, fgetc returns EOF and fread returns a short count for either end of file or read failure. Do not test feof before the read to predict whether data remains.

Indicators persist. clearerr clears both, as does rewind. Successful fseek or fsetpos clears end of file, but not an existing error. Clearing an indicator acknowledges it; it does not reconnect a removed drive or repair a damaged file. Retry only when the cause has been addressed.

Separate invalid data from failed access

If fscanf(fp, "%d", &value) returns 0 on "abc", conversion failed before any assignment. Neither end of file nor a read error is required. Report an invalid field, preferably with a line number. A message about the disk would describe the wrong problem.

If a required header is read as one element and fread returns 0, the header is incomplete. Do not inspect that partially filled object. If ferror is set, report an input error; if the file ended, report truncated data. An empty file and a partial header can produce the same element count, so the expected format supplies the requirement that the header must exist.

Catch delayed output failures

A disk can fill after the program has opened its output. Buffered writes can appear successful until fflush or fclose actually transfers pending bytes. Check the final close and let it turn an otherwise successful job into failure. Do not close the same stream again afterward.

At a terminal, Ctrl+D at the start of a line on Linux or macOS, or Ctrl+Z then Enter on Windows, commonly signals end of input. clearerr(stdin) clears the resulting indicator if the program needs another attempt. The terminal action and a read error remain different causes.

A return value tells you that an operation failed. An error code can help explain why. Use errno only in the context of the operation's documented behavior, and preserve it before unrelated library calls can change it.

Let the operation establish failure

errno is a modifiable int expression from <errno.h>, with thread-local storage duration in C11. It starts at zero. Library calls do not reset it to zero, and a successful call can leave or set a nonzero value. Testing errno after a successful fopen therefore does not tell you that the open failed.

On POSIX systems, a failed fopen sets an error code. Microsoft's C library also provides file error codes. Standard C does not require fopen to set errno. Portable reporting can clear it before the open and use a general message if no code was supplied:

errno = 0;
FILE *fp = fopen(name, "r");
if (fp == NULL) {
    int saved = errno;
    if (saved != 0)
        fprintf(stderr, "Cannot open %s: %s\n",
                name, strerror(saved));
    else
        fprintf(stderr, "Cannot open %s\n", name);
    return EXIT_FAILURE;
}

This snippet also needs <stdio.h>, <stdlib.h>, and <string.h>. Saving the code immediately keeps later reporting or cleanup calls from replacing the original reason. A saved code is useful even if the eventual message is printed much later.

Choose a message function

perror(label) writes the label, a colon and space, the current error message, and a newline to stderr. A typical missing-file message is "missing.txt: No such file or directory"; exact wording depends on the system.

strerror(code) returns the library's message for a supplied code, so it fits a custom diagnostic naming the program, operation, and file. Do not modify the returned string. Use strerror(saved) after cleanup instead of asking for the new value of errno.

C defines EDOM, ERANGE, and EILSEQ. Common file codes such as ENOENT, EACCES, EEXIST, and ENOSPC are supplied by POSIX and widely available C libraries. Match your code to the interface and platform you target. Do not assume numeric code values or exact English message text are universal.

Handle an ambiguous return value

For some functions, the result alone cannot distinguish success from a range error. strtol can return LONG_MAX as a valid number or as the result of overflow. Clear errno before converting, then inspect the documented range code:

errno = 0;
char *end;
long value = strtol(text, &end, 10);
if (end == text) {
    /* No digits were converted. */
} else if (errno == ERANGE) {
    /* The value is outside the long range. */
} else {
    /* Validate trailing characters and the target range. */
}

A useful diagnostic gives the user something to act on. Name the file and attempted action; preserve the system reason when available. Send it to stderr, leaving stdout available for valid result data.

Error handling is complete only when resources are released and the program reports the real outcome. Plan ownership when you open a stream, and make every later path honor that plan.

Give every open one close

If input opening fails, there is no stream to close. If output opening fails after input succeeded, close the input. If copying fails after both opened, close both, check the output close, and keep a failure status. Closing a pointer twice is not extra protection; it uses a finished stream.

Early-return code usually closes resources in reverse order. A shared cleanup label is useful when several failure paths need the same work. Initialize pointers to NULL, keep a failure status by default, and set success only after the processing phase finishes.

The following complete program copies distinct input and output files in binary mode. It uses generic messages because standard C does not require every stdio failure to supply errno.

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
    FILE *in = NULL, *out = NULL;
    int status = EXIT_FAILURE;
    int output_acquired = 0;
    unsigned char buf[512];
    size_t n;

    if (argc != 3) {
        fprintf(stderr, "Usage: %s input output\n", argv[0]);
        return EXIT_FAILURE;
    }
    in = fopen(argv[1], "rb");
    if (in == NULL) {
        fprintf(stderr, "Cannot open input: %s\n", argv[1]);
        goto cleanup;
    }
    out = fopen(argv[2], "wb");
    if (out == NULL) {
        fprintf(stderr, "Cannot open output: %s\n", argv[2]);
        goto cleanup;
    }
    output_acquired = 1;
    while ((n = fread(buf, 1, sizeof buf, in)) > 0) {
        if (fwrite(buf, 1, n, out) != n) {
            fprintf(stderr, "Write failed: %s\n", argv[2]);
            goto cleanup;
        }
    }
    if (ferror(in)) {
        fprintf(stderr, "Read failed: %s\n", argv[1]);
        goto cleanup;
    }
    status = EXIT_SUCCESS;

cleanup:
    if (out != NULL && fclose(out) == EOF) {
        fprintf(stderr, "Close failed: %s\n", argv[2]);
        status = EXIT_FAILURE;
    }
    if (in != NULL && fclose(in) == EOF) {
        fprintf(stderr, "Close failed: %s\n", argv[1]);
        status = EXIT_FAILURE;
    }
    if (output_acquired && status != EXIT_SUCCESS) {
        if (remove(argv[2]) != 0)
            fprintf(stderr, "Cannot remove incomplete output: %s\n",
                    argv[2]);
    }
    return status;
}

The input loop processes only bytes actually read. A short write jumps to cleanup; an input error is checked after the loop. The output close can still change success into failure. Removal is attempted only when this run successfully opened the output, so an opening failure does not trigger deletion of an unrelated file. The distinct-file requirement matters: "wb" would erase input if the two names identified the same file.

Preserve important existing data

Direct output opening cannot undo truncation. To replace valuable data, write under a separate temporary name first. Check every write and final close before renaming. Keep the original under a backup name until the new file is installed; check every rename and remove. If installation fails, report the recoverable file's location instead of deleting it.

A helper should close what it opened and return a success or failure result to its caller. The caller can decide whether to retry or exit. Returning EXIT_FAILURE after any incomplete step lets a script stop before a dependent action, such as deleting the original after a backup.