Comments (3)
I know scanf makes things much more comfortable, but in times of any possible input to a program it should be noted, that scanf is a very insecure funktion, resp. people are using it very insecure in a lot of cases.
Very common problems are:
- too long input: example: scanf("%20c") takes max up to 20 characters, then stops.
- scanf will write over an array's boundaries, almost no one makes sure it doesn't.
- In the end, if there is not enough space, the string gets truncated but does not end with '\0'. A "str[strlen(str)] = '\0';" after every call to scanf makes sure there are no unterminated strings.
- truncation can't be detected without comparing the input data to output data. ("open end problem").
For parsing data I rather suggest the classic string functions. Also strlcpy/strlcat from BSD are known to produce terminated strings. Makes things much more comfortable.
The classic functions like strcmp, sprintf, ... also may be considered bad, because of no length limit. There are also strncmp, snprintf, strncat/ncpy (which provides no termination), ...
With these classics you also have to deal with lengths/termination, but in "smaller steps", so one may see mistakes more easily.
In general scanf and gets are making my hair stand off from my arms. This is no critisizm, this is just a suggestion to think about. scanf may indeed be used securely, but it is very common to introduce memory-leaks or other problems...
from ttyplot.
While your claims are generally correct they are also very broad and I'm not sure if they are applicable to this specific use case. I would suggest that you look at scanf usage in ttyplot and refine your comment to be much more specific. Ideally please send a PR with suggested changes.
from ttyplot.
not needed
from ttyplot.
Related Issues (20)
- arguments broken HOT 22
- Please add a Fish shell completion file HOT 1
- [1.5.2] `ttyplot.c:129:9: runtime error: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'` HOT 5
- [1.5.2] `ttyplot -c X -2` fails to use ASCII character "X" for drawing? HOT 2
- (Plans and remaing todos for) Release 1.6.0 HOT 6
- ttyplot doesn't build (in general and on Void Linux) because of issues in the Makefile HOT 15
- Use of `M_PI` in `stresstest.c` is not C99 and unfortunately breaks compilation with musl libc HOT 5
- [1.6.1] Chart output corrupts after a few minutes on macOS? HOT 20
- Shortcut for live plot of memory usage? HOT 7
- [master] Fails to compile with error: cannot find -lcurses: No such file or directory
- [master] "make deb" is broken
- use hline() vline() instead of drawing by hand HOT 1
- better SIGWINCH handler HOT 2
- stdin closes on SIGWINCH on some systems HOT 3
- [1.5.1] Minimum window size assumptions can be violated? HOT 4
- error: format not a string literal and no format arguments HOT 6
- handle window resize on older systems HOT 2
- Multi-byte characters not supported? HOT 17
- Average should be calculated from the available samples instead of the total number of potentially availalbe values HOT 4
- Release a new version and support -v option? HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ttyplot.