Newsgroups: comp.lang.c
Path: utzoo!utgpu!utstat!geoff
From: geoff@utstat.uucp (Geoff Collyer)
Subject: Re: retiring gets(3)
Message-ID: <1988Nov14.220842.3980@utstat.uucp>
Organization: Statistics, U. of Toronto
Date: Mon, 14 Nov 88 22:08:42 GMT

> From: gwyn@smoke.BRL.MIL (Doug Gwyn )
> 
> Bullshit.  When I use gets() I use it safely.

Okay, Doug, let's take this again from the top.  I'll use simple words
and try to make myself utterly clear, and I won't even abuse your
ancestry or swear at you, which I think is awfully polite of me, under
the circumstances.

To be proven: gets(3) should be abolished.

Any program which uses gets(3) can be corrupted by giving it a
long-enough input line.  There is no protection possible against such an
attack, other than sh's trick of making the gets buffer the last object
in the data segment, catching the resulting SIGSEGV signal, growing the
data segment and returning from the signal catcher, and this is
certainly not portable to Cray-1s and Sun-3s, for example.  gets is
probably unique among C library functions because it cannot be used
safely, no matter how hard you wish or how hard you work.  Thus there
seems little point (aside from writing unsafe programs) in continuing to
support gets in standards and C libraries.  QED
-- 
Geoff Collyer	utzoo!utstat!geoff, geoff@utstat.toronto.edu