3 ms·
The longer I look at this example, the more weirdness I spot: - There are no standard integer types that take 15 (decimal) digits to represent. - The array co
by WJW 5y ago
The longer I look at this example, the more weirdness I spot:
- There are no standard integer types that take 15 (decimal) digits to represent.
- The array contains ints instead of chars
- Why would you use fgets() instead of just gets()? (Though I don't touch C very often so perhaps that is considered proper style)
- Obviously no conversion of the digits into else, let alone specifying a base or handling a `0x` prefix for hexadecimal or a minus sign for negative numbers.
- leetcrew 5y agogets is inherently unsafe unless the input is guaranteed (externally) to never overflow the buffer.
- jhgb 5y ago> Why would you use fgets() instead of just gets()? I assume it's because gets() ranks as "-10: It's impossible to get right" on Rusty's API Design Manifesto? (http://sweng.the-davies.net/Home/rustys-api-design-manifesto http://sweng.the-davies.net/Home/rustys-api-design-manifesto)
- WJW 5y agoTIL. I have been leading a sheltered life in languages with garbage collectors that obscured the true horror of gets() from me.
- mpweiher 5y agoman gets ... SECURITY CONSIDERATIONS The gets() function cannot be used securely. Because of its lack of bounds checking, and the inability for the calling program to reliably determine the length of the next incoming line, the use of this function enables malicious users to arbitrarily change a running program's func- tionality through a buffer overflow attack. It is strongly suggested that the fgets() function be used in all cases. (See the FSA.)
- Someone 5y ago> There are no standard integer types that take 15 (decimal) digits to represent Nitpick: that is irrelevant. The code reads in at most 14 characters. > Why would you use fgets() instead of just gets()? You don’t use gets because it doesn’t exist anymore. It got removed in C11 (it rightfully was deemed so bad that backwards compatibility was sacrificed). You can use char *gets_s( char *str, rsize_t n ) , though. (https://en.cppreference.com/w/c/io/gets https://en.cppreference.com/w/c/io/gets)