30

I thought it is pretty cool to use the gets() function because it is like the scanf() wherein I could get an input with whitespace. But I read in one of the threads (student info file handling) that it is not good to use because according to them, it is a devil's tool for creating buffer overflows (which I don't understand)

If I use the gets() function, I could do this. ENTER YOUR NAME: Keanu Reeves.

If I use the scanf(), I could only do this. ENTER YOUR NAME: Keanu

So I heed their advice and replaced all my gets() code with fgets(). The problem is now some of my code are not working anymore...are there any functions other than gets() and fgets() which could read the whole line and which ignores the whitespace.

0

6 Answers 6

40

it is a devil's tool for creating buffer overflows

Because gets does not take a length parameter, it doesn't know how large your input buffer is. If you pass in a 10-character buffer and the user enters 100 characters -- well, you get the point.

fgets is a safer alternative to gets because it takes the buffer length as a parameter, so you can call it like this:

fgets(str, 10, stdin);

and it will read in at most 9 characters.

the problem is now some of my code are not working anymore

This is possibly because fgets also stores the final newline (\n) character in your buffer -- if your code is not expecting this, you should remove it manually:

int len = strlen(str);
if (len > 0 && str[len-1] == '\n')
  str[len-1] = '\0';
4
  • 2
    @casablanka: you need to check that len > 0 before dereferencing at len - 1, I think.
    – unwind
    Commented Dec 3, 2010 at 14:58
  • 2
    Note that you should always capture the result of fgets(): if (fgets(str, 10, stdin) != 0) { ...OK... } else { ...EOF or error... }. Using ferror() or feof() is not advisable; we just fixed a performance bug on AIX where the code ignored the errors from primary I/O functions like fputs() and used ferror() instead and the slowdown was noticeable. Commented Dec 3, 2010 at 18:33
  • gets() automatically appends Null-Terminator to the end of the string and doesn't append the \n, correct?
    – Minh Tran
    Commented Dec 31, 2016 at 3:40
  • @MinhTran: Yes, if you look at the documentation, it says that gets discards the newline, but fgets keeps it. Both functions will append a null terminator to the end of the string.
    – casablanca
    Commented Dec 31, 2016 at 20:14
13

As other responses have noted, gets() doesn't check the buffer space. In addition to accidental overflow problems, this weakness can be used by malicious users to create all sorts of havoc.

One of the first widespread worms, released in 1988, used gets() to propogate itself throughout the internet. Here's an interesting excerpt from Expert C Programming by Peter Van Der Linden which discusses how it worked:

The Early Bug gets() the Internet Worm

The problems in C are not confined to just the language. Some routines in the standard library have unsafe semantics. This was dramatically demonstrated in November 1988 by the worm program that wriggled through thousands of machines on the Internet network. When the smoke had cleared and the investigations were complete, it was determined that one way the worm had propagated was through a weakness in the finger daemon, which accepts queries over the network about who is currently logged in. The finger daemon, in.fingerd, used the standard I/O routine gets().

The nominal task of gets() is to read in a string from a stream. The caller tells it where to put the incoming characters. But gets() does not check the buffer space; in fact, it can't check the buffer space. If the caller provides a pointer to the stack, and more input than buffer space, gets() will happily overwrite the stack. The finger daemon contained the code:

main(argc, argv)
char *argv[];
{
char line[512];
...
gets(line);

Here, line is a 512-byte array allocated automatically on the stack. When a user provides more input than that to the finger daemon, the gets() routine will keep putting it on the stack. Most architectures are vulnerable to overwriting an existing entry in the middle of the stack with something bigger, that also overwrites neighboring entries. The cost of checking each stack access for size and permission would be prohibitive in software. A knowledgeable malefactor can amend the return address in the procedure activation record on the stack by stashing the right binary patterns in the argument string. This will divert the flow of execution not back to where it came from, but to a special instruction sequence (also carefully deposited on the stack) that calls execv() to replace the running image with a shell. Voilà, you are now talking to a shell on a remote machine instead of the finger daemon, and you can issue commands to drag across a copy of the virus to another machine.

Ironically, the gets() routine is an obsolete function that provided compatibility with the very first version of the portable I/O library, and was replaced by standard I/O more than a decade ago. The manpage even strongly recommends that fgets() always be used instead. The fgets() routine sets a limit on the number of characters read, so it won't exceed the size of the buffer. The finger daemon was made secure with a two-line fix that replaced:

gets(line);

by the lines:

if (fgets(line, sizeof(line), stdin) == NULL)
exit(1);

This swallows a limited amount of input, and thus can't be manipulated into overwriting important locations by someone running the program. However, the ANSI C Standard did not remove gets() from the language. Thus, while this particular program was made secure, the underlying defect in the C standard library was not removed.

1
  • 2
    The C1X standard is due to remove gets(); it will be a long time before implementations do. With luck, GNU will replace current gets() with: char *gets(char *buffer) { abort(); }. Commented Dec 3, 2010 at 17:50
4

You could look at this question: Safe alternative to gets(). There are a number of useful answers.

You should be more precise about why your code does not work with fgets(). As the answers in the other question explain, you have to deal with the newline that gets() omits.

0
2

To read all the words using scanf you can do it like this

Example :

printf("Enter name: ");

scanf("%[^\n]s",name);       //[^\n] is the trick
1

You can use scanf to mimic gets. It's not pretty though.

#include <stdio.h>

#define S_HELPER(X) # X
#define STRINGIZE(X) S_HELPER(X)
#define MAX_NAME_LEN 20

int flushinput(void) {
  int ch;
  while (((ch = getchar()) != EOF) && (ch != '\n')) /* void */;
  return ch;
}

int main(void) {
  char name[MAX_NAME_LEN + 1] = {0};

  while (name[0] != '*') {
    printf("Enter a name (* to quit): ");
    fflush(stdout);
    scanf("%" STRINGIZE(MAX_NAME_LEN) "[^\n]", name); /* safe gets */
    if (flushinput() == EOF) break;
    printf("Name: [%s]\n", name);
    puts("");
  }

  return 0;
}

You're much better off reading with fgets and parsing (if needed) with sscanf.


EDIT explaining the scanf call and surrounding code.

The "%[" conversion specification of scanf accepts a maximum field width that does not include the null terminator. So the array to hold the input must have 1 more character than read with scanf.

To do that with only a single constant I used the STRINGIZE macro. With this macro I can use a #define'd constant both as an array size (for the variable definition) as a string (for the specifier).

There's one more aspect that deserves mention: the flushinput. If using gets, all data is written to memory (even when the buffer overflows) up to but not including the newline. To mimic that, the scanf reads a limited number of characters up to but not including the newline and, unlike gets, keeps the newline in the input buffer. So that newline needs to be removed and that's what flushinput does.

The rest of the code was mainly to set up a testing environment.

5
  • for me your code is pretty tough. but i'll try to study this. thanks
    – newbie
    Commented Dec 3, 2010 at 15:33
  • I meant "it's not pretty though" :-) Edited and I'll add a few comments to the code.
    – pmg
    Commented Dec 3, 2010 at 15:39
  • This isn't exactly equivalent to gets() yet; it does not read the newline. Further, adding \n to the end of the format string is not the answer (it would be an astoundingly bad idea). You probably need to read the next character with getchar() and unputc() it if it was not a newline (or EOF). Commented Oct 14, 2013 at 22:07
  • 2
    @JonathanLeffler: Add %*1[\n] to the end of the format string to consume the newline if it exists.
    – Chris Dodd
    Commented Oct 15, 2013 at 1:39
  • @ChrisDodd: that's neat! Commented Oct 15, 2013 at 2:15
1

You can read more than one field with scanf(), so you can do:

scanf("%s %s\n", first_name,  last_name);

However, I think it would be better to read a string and then split it yourself since they may not have entered just a first name, or first/middle/last.

What are the problems you are having with fgets()?

The problem with gets() is that it returns as many characters as the user enters - you as the caller have no control over this. So you might allocate 80 characters, the user may type 100 characters and the last 20 will be written off the end of the memory you have allocated, stomping on who knows what.

3
  • And as a design issue, if you don't want to deal with the user entering first, first+last, or first+middle+last, I would prompt them sepeately for surname and last name ... Commented Dec 3, 2010 at 15:00
  • i also want to separate the first name, middle name and last name... but our teacher gives us the specification to put it in arrayname[31]
    – newbie
    Commented Dec 3, 2010 at 15:10
  • That's OK. Prompt for them separately then concatenate them before putting it into arrayname Commented Dec 3, 2010 at 15:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.