TIP: Click on subject to list as thread! ANSI
echo: c_plusplus
to: RIMU ATKINSON
from: JONATHAN DE BOYNE POLLARD
date: 1998-03-26 09:40:00
subject: Phil`s an idiot

 RA> use the gets() function to get a line of text from stdin.
... and thereby give your code the exact same vulnerability that was 
explioted in `finger' and `sendmail' by the Internet Worm of 1987.
When the content of a data stream can be determined by the user, and can 
therefore be of arbitrary length, *never* use gets() to read from the stream, 
since it cannot check for buffer overruns.  Use fgets() or 
tream::getline().
 ¯ JdeBP ®
--- FleetStreet 1.19 NR
---------------
* Origin: JdeBP's point, using Squish (2:440/4.3)

SOURCE: echomail via exec-pc

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.