protect the program from buffer overflow?

Question

I got a small program which is vulnerable to buffer overflow. For example, the arrays are limited to 8 characters, but still I am able to more to it. I realized that gets() is vulnerable so I planned to use fgets(). This this function, I am getting segmentation error.

Also, other recommendations are welcome.

Thank you

#include <string.h>

int main(int argc, char *argv[]){   
int valid = 0;    
char str1[8];    
char str2[8];
printf ("Enter value for str1: ") ;

fgets(str1, sizeof(str1), stdin);  

printf ("Enter value for str2: ") ;

fgets(str2, sizeof(str2), stdin);

if (strncmp (str1, str2, 8) == 0)  
{       valid = 1;
}
printf("buffer: str1(%s), str2(%s), valid(%d)\n", str1, str2, valid);   
return 0;
}

Please show us the code which is supposed to work, using `fgets`. You've already told us what's wrong with the given program. — Potatoswatter, Nov 18 '14 at 23:30
I changed gets() for fgets(). I posted gets() initially because that was a code which works and I asked for help. Hopefully, now we understand each other. — user3131067, Nov 19 '14 at 01:33
@user3131067 show the new code with `fgets` that results in segfault. — Jabberwocky, Nov 19 '14 at 12:42
[Works for me](http://ideone.com/tODsxv). How did you get a segfault? — Potatoswatter, Nov 21 '14 at 08:27
@Potatoswatter: Why the rollback? The original question contained `gets` and the only answer addresses `gets`, so I think it should stay in the question. — mafso, Nov 22 '14 at 03:09
@mafso The code originally posted contained `gets`, but it did not match the actual question. See the above comments. — Potatoswatter, Nov 23 '14 at 00:59

score 2 · Answer 1 · edited May 23 '17 at 11:57

Please reference: Why is the gets function so dangerous that it should not be used? I understand that you indicated that you already know gets is a vulnerable keyword to use in C but you still provided code for using gets...

When trying to get or store strings it is more preferable to use fgets as the format follows a buffer of space to read in strings or characters from the user: char *fgets(char *str, int n, FILE *stream).

protect the program from buffer overflow?

1 Answers1