Why is the gets function so dangerous that it should not be used?

c fgets buffer-overflow gets
vinit dhatrak picture vinit dhatrak · Nov 7, 2009 · Viewed 164.6k times · Source

When I try to compile C code that uses the gets() function with GCC, I get this warning:

(.text+0x34): warning: the `gets' function is dangerous and should not be used.

I remember this has something to do with stack protection and security, but I'm not sure exactly why.

How can I remove this warning and why is there such a warning about using gets()?

If gets() is so dangerous then why can't we remove it?

Answer

Thomas Owens picture Thomas Owens · Nov 7, 2009

In order to use gets safely, you have to know exactly how many characters you will be reading, so that you can make your buffer large enough. You will only know that if you know exactly what data you will be reading.

Instead of using gets, you want to use fgets, which has the signature

char* fgets(char *string, int length, FILE * stream);

(fgets, if it reads an entire line, will leave the '\n' in the string; you'll have to deal with that.)

It remained an official part of the language up to the 1999 ISO C standard, but it was officially removed by the 2011 standard. Most C implementations still support it, but at least gcc issues a warning for any code that uses it.

Related questions

Removing trailing newline character from fgets() input

I am trying to get some data from the user and send it to another function in gcc. The code is something like this. printf("Enter your Name: "); if (!(fgets(Name, sizeof Name, stdin) != NULL)) { fprintf(stderr, "Error reading Name.\…

Read More
How to read from stdin with fgets()?

I've written the following code to read a line from a terminal window, the problem is the code gets stuck in an infinite loop. The line/sentence is of undefined length, therefore I plan to read it in parts into …

Read More
C - scanf() vs gets() vs fgets()

I've been doing a fairly easy program of converting a string of Characters (assuming numbers are entered) to an Integer. After I was done, I noticed some very peculiar "bugs" that I can't answer, mostly because of my limited knowledge …

Read More