why the usage of gets() is dangerous.

[jayapal]

Hi all,

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

regards,
jayapal.

[John Gordon]

In <2f************ *************** *******@n20g200 0hsh.googlegrou ps.comjayapal <ja********@gma il.comwrites:

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

gets() does not allow you limit the amount of input, which means it
can potentially overflow the buffer into which the input is placed.

--
John Gordon A is for Amy, who fell down the stairs
go****@panix.co m B is for Basil, assaulted by bears
-- Edward Gorey, "The Gashlycrumb Tinies"

[jayapal]

On Nov 16, 10:10 pm, John Gordon <gor...@panix.c omwrote:

gets() does not allow you limit the amount of input, which means it
can potentially overflow the buffer into which the input is placed.

Can u explain the differences b/w the scanf() and gets() ..?

Thanks,
Jayapal

[Ben Bacarisse]

jayapal <ja********@gma il.comwrites:

On Nov 16, 10:10 pm, John Gordon <gor...@panix.c omwrote:

>gets() does not allow you limit the amount of input, which means it
can potentially overflow the buffer into which the input is placed.

Can u explain the differences b/w the scanf() and gets() ..?

Presumably you mean for string input? Using 'scanf("%[^\n]", buf)'
has the same problem as 'gets'. But scanf can be saved (just about)
since it permits a bounded input operation:

char buf[100];
...
if (scanf("%99[^\n]", buf) == 1) ...

--
Ben.

[jacob navia]

jayapal wrote:

Hi all,

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

regards,
jayapal.

That function is deprecated and will disappear shortly.
Its usage is not recommended because there is no way to
limit the input that it will receive, and it can overflow
the input buffer.

--
jacob navia
jacob at jacob point remcomp point fr
logiciels/informatique
http://www.cs.virginia.edu/~lcc-win32

[CJ]

On 16 Nov 2007 at 18:41, jacob navia wrote:

jayapal wrote:

>Hi all,

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

regards,
jayapal.

That function is deprecated and will disappear shortly.
Its usage is not recommended because there is no way to
limit the input that it will receive, and it can overflow
the input buffer.

This sort of absolute prohibition on gets() is completely wrong-headed.
It's completely fine to use gets(), as long as you use it properly. To
use it properly, *you* need to be in control of the data that gets()
reads. For throwaway utility routines this will often be the case, and
there's no problem using gets() in this case.

[dj3vande]

In article <sl************ *******@nospam. com>, CJ <no****@nospam. comwrote:

>This sort of absolute prohibition on gets() is completely wrong-headed.
It's completely fine to use gets(), as long as you use it properly. To
use it properly, *you* need to be in control of the data that gets()
reads. For throwaway utility routines this will often be the case, and
there's no problem using gets() in this case.

Except that throwaway code has an annoying habit of not getting thrown
away. If you make a habit of using gets in your throwaway code, sooner
or later it WILL escape into the wild, and once that happens it's only
a matter of time before it becomes an exploitable bug.
dave

[Flash Gordon]

jayapal wrote, On 16/11/07 17:18:

On Nov 16, 10:10 pm, John Gordon <gor...@panix.c omwrote:

>gets() does not allow you limit the amount of input, which means it
can potentially overflow the buffer into which the input is placed.

Can u explain the differences b/w the scanf() and gets() ..?

Please don't use contractions like "u" for "you" or "b/w" for "between".
They make it far harder to read your posts. For example, a lot of people
will be more likely to read "b/w" as "black and white" then "between"
and then have to work out what you actually meant.

As to your question, it is almost easier to say what the similarities
are. The main similarity is that they both get input from stdin, after
that they are very different. gets just keep reading input in to the
memory you provide a pointer to until either a newline is encountered or
your program crashes. scanf reads input as specified by the format
specifier you provide. With work, scanf *can* be used safely (although
it is not easy for a novice) but it is virtually impossible to use gets
safely and it definitely cannot be used safely for user input.

I would recommend you learn to use fgets and getc and build your input
routines using these function and separate passing. You can use sscanf
for the passing if you like, although you have to be careful, since it
is not as hard to use sscanf correctly as it is to use scanf or fscanf
correctly.
--
Flash Gordon

[Richard Heathfield]

CJ said:

On 16 Nov 2007 at 18:41, jacob navia wrote:

>jayapal wrote:

>>Hi all,

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

regards,
jayapal.

That function is deprecated and will disappear shortly.
Its usage is not recommended because there is no way to
limit the input that it will receive, and it can overflow
the input buffer.

This sort of absolute prohibition on gets() is completely wrong-headed.

No, it isn't. (Even a stopped clock is right twice a day.) There is never a
good reason to use the gets function.

It's completely fine to use gets(), as long as you use it properly.

To use it properly, precede it with an 'f', and modify the syntax of the
call accordingly.

To
use it properly, *you* need to be in control of the data that gets()
reads. For throwaway utility routines this will often be the case, and
there's no problem using gets() in this case.

That would be fine, if it were not for the facts that (a) you're not
necessarily as much in control of the data as you think you are, and (b)
throwaway routines have a bad habit of not being thrown away.

--
Richard Heathfield <http://www.cpax.org.uk >
Email: -http://www. +rjh@
Google users: <http://www.cpax.org.uk/prg/writings/googly.php>
"Usenet is a strange place" - dmr 29 July 1999

[karthikbalaguru]

On Nov 16, 10:04 pm, jayapal <jayapal...@gma il.comwrote:

Hi all,

Whenever I use the gets() function, the gnu c compiler gives a
warning that it is dangerous to use gets(). why...?

gets is very very dangerous. Handle with care :):)
It has buffer related worries.(Expect s newline in its pocket to
work without causing any harm !)

Karthik Balaguru