Mail Archives: djgpp/2000/10/16/16:45:20.1
"Richard Heathfield" wrote:
> ChuckEasttom wrote:
> > Richard Heathfield wrote:
>
> > > Schildt is probably the primary reason that so many C programmers use
> > > gets().
> >
> > Ditto, whether you or I like it, that piece of code is part of the C
> > language.
>
> True, but it can never be used safely. The Internet Worm of 1988
> exploited gets()'s inherent weakness for malicious purposes. There's
> really no reason to deliberately introduce weaknesses and security holes
> into your code. Schildt has a responsibility, as a C populariser, to be
> aware of this problem and to guide people away from it. He has failed so
> to do.
To be fair, he does point this out in his book "C/C++ Programmer's
Reference." In his explanation of gets(), he adds a "Programming Tip" which
describes the dangers of using gets() and offers fgets(), specifying stdin
for the input stream, as an alternative.
Um... but then in the example code he gives for using fgets(), he repeats
the bug you pointed out in your earlier post with the example from "C - The
Complete Reference" by using printf() to print a string literal without
including the newline character or flushing the output stream after the
printf() call.
- Raw text -