scanf()scanf() and friends and friends
/* /* the most popular input functions fromthe most popular input functions from <stdio.h> <stdio.h>:: */ */
int i = getchar();int i = getchar();/* /* notenote int int, not, not char char;;
getchar() getchar() returnsreturns EOF EOF when it reaches end of file when it reaches end of file */*/
char* q = gets(p);char* q = gets(p);/* /* read 'read '\n\n'' terminated line intoterminated line into char char array pointed to byarray pointed to by p p */*/
/* /* sets sets qq to to pp if read succeeds; sets if read succeeds; sets qq to to NULLNULL if read fails if read fails */*/
void f(int* pi, char* pc, double* pd, char* ps)void f(int* pi, char* pc, double* pd, char* ps)
{{/*/* read into variables whose addresses are passed as pointers: read into variables whose addresses are passed as pointers: */*/
scanf("%i %c %g %s", pi, pc, pd, ps);scanf("%i %c %g %s", pi, pc, pd, ps);
/* /* %s %s skips initial whitespace and is terminated by whitespaceskips initial whitespace and is terminated by whitespace */ */
}}
int i; char c; double d; char s[100]; f(&i, &c, &d, s); /* int i; char c; double d; char s[100]; f(&i, &c, &d, s); /* call to assign to call to assign to ii,, c c,, d d, and , and s s */*/
DonDon’’t t everever use use gets()gets() or or scanf("%s")scanf("%s")!!
Consider them poisonedConsider them poisoned
They are the source of They are the source of manymany security violations security violations
An overflow is easily arranged and easily exploitableAn overflow is easily arranged and easily exploitable
Use Use getchar()getchar()
1818Stroustrup/PPP - Dec'13Stroustrup/PPP - Dec'13