But the class here is DoS-able, not buffer overrun. The “fixed” version of gets takes a max string length. This DoS-able function already does that. The concern

But the class here is DoS-able, not buffer overrun. The “fixed” version of gets takes a max string length. This DoS-able function already does that. The concern here is different in that the library’s design encourages using untrusted input (Content-Length) to set the buffer size.