Mail Archives: djgpp/2001/12/10/12:02:57
Aaron Evans <ahde AT oz DOT net> wrote:
> Richard Bos wrote:
>
> > That's what people thought before the Internet worm struck, yes. Believe
> > you me: every single use of gets() is a mistake. Sooner or later, you
> > _will_ get bitten by it.
>
> how is
>
> gets(filename) || length > MAXLINELENGTH
>
> more dangerous than
>
> fgets (strline, MAXLINELENGTH, fileptr);
fgets() will read MAXLINELENGTH characters at most, and stop reading
when it reaches its limit. gets(), OTOH, will stop at nothing but a
'\n'. If you feed it more input than it has memory for, it will merrily
(try to) write beyond the memory it is allowed to write in, overwriting
what was already there.
If you're lucky, that's just another string variable, leading to
semi-obvious junk. If you're really lucky, it's an address, leading to a
very obvious crash. If you're unlucky, gets() could overwrite vital
data, in a way that you won't detect until you've already used them. If
you're really unlucky, those vital data contain your length variable,
which could make your check for buffer overflow never even evaluate to
true...
In all these cases, though, the damage is done during the gets() call.
By the time you get to check for overflow, the damage has already been
done, and there's nothing you can do to stop it being done, because
gets() just does not check anything. fgets() does.
Richard
- Raw text -