Switch to ANSI Windows API in `fsbridge::fopen()` function
What the developer wrote
Authored by Hennadii Stepanov
Switch to ANSI Windows API in `fsbridge::fopen()` function
What changed, and why it matters
This commit changes how Bitcoin Core opens files on Windows. Previously it used a Unicode-aware Windows function (`_wfopen`) that could handle non-English characters in file paths. Now it uses the older ANSI `fopen`, which only reliably supports a limited set of characters. On some Windows systems this could make file paths containing certain characters fail to open, potentially causing wallet or data file errors. It is not a direct remote exploit, but it is a reliability/security-adjacent change on Windows.
Review whether Bitcoin Core explicitly sets the UTF-8 process codepage on Windows (e.g., via manifest or `SetConsoleOutputCP`/`SetThreadLocale`) before relying on `fopen` with UTF-8 strings. If not, consider using `MultiByteToWideChar` + `_wfopen` or `CreateFileW` directly to preserve Unicode path support. Test file open operations with non-ASCII paths on Windows 10 and earlier versions.
Security signals we found
Windows path handling regression
Removal of Unicode-aware file open API
Potential failure to open wallet/data files with non-ASCII paths
C++ codecvt deprecation workaround may have security side effects
Evidence from the diff
The patch removes the use of std::codecvt_utf8_utf16 and ::_wfopen in fsbridge::fopen() on Windows, replacing them with ::fopen using path.utf8string(). On Windows, fopen expects an ANSI (codepage) path string, not UTF-8. While some modern Windows runtimes accept UTF-8 when the process codepage is set to UTF-8, this is not guaranteed on older versions or default configurations. The change therefore risks path-handling regressions for non-ASCII filenames, which could affect wallet files, block data paths, or logs. The commit message frames this as a deliberate switch to the ANSI API, likely to avoid deprecation/removal of <codecvt> in newer C++ standards, but it introduces a portability concern.
Changed components
src/util/fs.cppfsbridge::fopen()Windows builds of Bitcoin CoreInspect captured patch +1 / −3
diff --git a/src/util/fs.cpp b/src/util/fs.cpp
index ec4d551e..692f6718 100644
--- a/src/util/fs.cpp
+++ b/src/util/fs.cpp
@@ -12,7 +12,6 @@
#include <sys/utsname.h>
#include <unistd.h>
#else
-#include <codecvt>
#include <limits>
#include <windows.h>
#endif
@@ -28,8 +27,7 @@ FILE *fopen(const fs::path& p, const char *mode)
#ifndef WIN32
return ::fopen(p.c_str(), mode);
#else
- std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>,wchar_t> utf8_cvt;
- return ::_wfopen(p.wstring().c_str(), utf8_cvt.from_bytes(mode).c_str());
+ return ::fopen(p.utf8string().c_str(), mode);
#endif
}
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.