Скачать или смотреть How to Replace gets() with fgets() in C Programming

Discover how to safely replace the `gets()` function with `fgets()` in your C code and avoid common pitfalls.
---
This video is based on the question https://stackoverflow.com/q/65276793/ asked by the user 'Geez567899' ( https://stackoverflow.com/u/14818219/ ) and on the answer https://stackoverflow.com/a/65276961/ provided by the user 'Saad Hussain' ( https://stackoverflow.com/u/11810583/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to change the gets() code to fgets()?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding the Replacement of gets() with fgets()

The Problem

The gets() function in C has been widely criticized for its lack of safety, particularly because it does not check the size of the input buffer, leading to potential buffer overflows. This can cause serious vulnerabilities in your applications. In light of this, many programmers choose to replace gets() with fgets() which is considered safer since it allows you to define a maximum input size.

In this post, we will guide you through the process of replacing gets() with fgets(), addressing potential errors and fixes along the way.

Why fgets() is Better

Before we dive into the code, here are a few reasons why fgets() is preferred over gets():

Safety: fgets() limits the number of characters read, preventing buffer overflows.

Control: You can determine the size of your input buffer and avoid unexpected input lengths.

Code Breakdown

Let's start by looking at the original code that uses gets():

[[See Video to Reveal this Text or Code Snippet]]

In this code, the key point is that you are using gets() to read user input into a 7-character buffer without checking if the user inputs more than 6 characters (the 7th character is reserved for the null terminator). This can easily lead to a buffer overflow.

The Solution

Now, let’s replace gets() with fgets(). The declaration of fgets() looks like this:

[[See Video to Reveal this Text or Code Snippet]]

Parameters:

str: A pointer to an array where the input string is stored.

n: The maximum number of characters to read, including the null terminator.

stream: The input stream, typically stdin for standard input.

The Updated Code

Here’s how you would modify the original code to use fgets() safely:

[[See Video to Reveal this Text or Code Snippet]]

Key Changes Explained:

Buffer Declaration: We define a buffer size using a macro (# define BUFLEN 7), making it easier to change the buffer size if needed in the future.

Reading Input: fgets(buf, BUFLEN, stdin); is used to read input from standard input. Beware that this function also reads the newline character if it's present within the buffer limit.

Error Handling: While our code currently does not include error handling, it’s good practice to check if fgets() was successful by assessing whether the return value is NULL.

Conclusion

By replacing gets() with fgets(), you significantly enhance the safety of your C programs. Remember that proper input validation is key to maintaining the integrity and security of your applications. Always opt for safer functions that provide a built-in way to handle buffer limitations.

For those of you currently working with legacy code that uses gets(), make it a priority to refactor to fgets() to avoid any security vulnerabilities. Happy coding!