Giter Club home page Giter Club logo

Comments (3)

spacerace avatar spacerace commented on May 20, 2024

I know scanf makes things much more comfortable, but in times of any possible input to a program it should be noted, that scanf is a very insecure funktion, resp. people are using it very insecure in a lot of cases.
Very common problems are:

  • too long input: example: scanf("%20c") takes max up to 20 characters, then stops.
  • scanf will write over an array's boundaries, almost no one makes sure it doesn't.
  • In the end, if there is not enough space, the string gets truncated but does not end with '\0'. A "str[strlen(str)] = '\0';" after every call to scanf makes sure there are no unterminated strings.
  • truncation can't be detected without comparing the input data to output data. ("open end problem").

For parsing data I rather suggest the classic string functions. Also strlcpy/strlcat from BSD are known to produce terminated strings. Makes things much more comfortable.
The classic functions like strcmp, sprintf, ... also may be considered bad, because of no length limit. There are also strncmp, snprintf, strncat/ncpy (which provides no termination), ...

With these classics you also have to deal with lengths/termination, but in "smaller steps", so one may see mistakes more easily.

In general scanf and gets are making my hair stand off from my arms. This is no critisizm, this is just a suggestion to think about. scanf may indeed be used securely, but it is very common to introduce memory-leaks or other problems...

from ttyplot.

tenox7 avatar tenox7 commented on May 20, 2024

While your claims are generally correct they are also very broad and I'm not sure if they are applicable to this specific use case. I would suggest that you look at scanf usage in ttyplot and refine your comment to be much more specific. Ideally please send a PR with suggested changes.

from ttyplot.

tenox7 avatar tenox7 commented on May 20, 2024

not needed

from ttyplot.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.