Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 12 Feb 2019 09:41:40 -0500
From: James Larrowe <larrowe.semaj11@...il.com>
To: musl@...ts.openwall.com
Subject: Re: Bug in gets function?

I could probably try patching it. That C99 specification seems descriptive
enough.

On Mon, Feb 11, 2019 at 10:51 PM Rich Felker <dalias@...c.org> wrote:

> On Mon, Feb 11, 2019 at 10:48:38PM -0500, Rich Felker wrote:
> > On Mon, Feb 11, 2019 at 06:55:24PM -0800, Keyhan Vakil wrote:
> > > Hi. It seems that the gets function does not follow the C99 spec. In
> > > particular, if the input contains a null byte in the middle of the
> > > input, then the new-line character is not discarded.
> > >
> > > For reference, here's the relevant part in the C99 standard
> > > (7.19.7.7):
> > >
> > > > The gets function reads characters from the input stream pointed to
> > > > by stdin, into the array pointed to by s, until end-of-file is
> > > > encountered or a new-line character is read. Any new-line character
> > > > is discarded, and a null character is written immediately after the
> > > > last character read into the array.
> > >
> > > Here is an example:
> > >
> > >     #include <stdio.h>
> > >     char s[8];
> > >     int main() {
> > >         gets(s);
> > >         for (int i = 0; i < sizeof s; i++) {
> > >             printf("%02x ", s[i]);
> > >         }
> > >         printf("\n");
> > >         return 0;
> > >     }
> > >
> > > When compiled against gcc:
> > >
> > >     $ echo -e 'A\x00B' | ./a.out
> > >     41 00 42 00 00 00 00 00
> > >
> > > When compiled against musl:
> > >
> > >     $ echo -e 'A\x00B' | ./a.out
> > >     41 00 42 0a 00 00 00 00
> > >
> > > Note the terminating newline, which contradicts the spec.
> >
> > I think this bug report is correct; however the gets function is
> > awful, removed in C11, and should never be used. :-)
> >
> > I will see what can be done to fix it though.
>
> Is gets(s) equivalent to scanf("%[^\n]%*1[\n]",s)? If so that would be
> an appropriately hideous way to implement it that avoids the current
> bug? :-)
>
> Rich
>

Content of type "text/html" skipped

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.