gets() has got me!

This is a discussion on gets() has got me! within the C Programming forums, part of the General Programming Boards category; hi all, I've got a problem with gets(). My program (cgi) lives on a web server and takes input from ...

  1. #1
    Registered User
    Join Date
    Feb 2003
    Posts
    7

    gets() has got me!

    hi all,

    I've got a problem with gets().

    My program (cgi) lives on a web server and takes input from a form.
    However when it is invoked it just hangs and times out. I'm told by an expert that the problem is with gets() which expects input from stdin ie the keyboard . ie it hangs waiting for someone to hit a key. In the context of the server it is going to wait for a long time (which it does). This makes sense to me BUT what confuses me is that it works ok at home, with the browser on one pc and a server on another (httpd) and my prog in the cgi bin.
    Why doesn't it hang at home waiting for a keystroke ? Whats the difference.
    here is my problem code

    Code:
    int main()
    {
    char s[2000]; // array for gets
         
    gets(s); 
    
     /*takes input from form and puts it in s, which is a  param to the parsers process () and process2().
    PROBLEM HERE*/
    
    
    process(s); 
    
    
    process2(s); 
    
     return 0;
    }

    I have a weak grasp of what going on here. Is the above explanation ok?

    What I really mean is, is there a simple way out ie another function to replace gets() in the context of CGI

    Any help would be greatly appreciated

  2. #2
    End Of Line Hammer's Avatar
    Join Date
    Apr 2002
    Posts
    6,231
    >> I've got a problem with gets().
    We all do

    >>My program (cgi) lives on a web server
    Are you nuts? Using gets() on a web server processing input from the client??!! You're opening the door ready to let anyone in.

    gets() doesn't check the array bounds, so if the client passed 4000 bytes of data, gets() would shove that into the 2000 byte array you've allocated. That means the trailing 2000 bytes have overwritten memory they're not supposed to, and you're in big trouble

    Try fgets() instead, this does bounds checking, and is therefore much more secure.

    I haven't done any CGI stuff in C myself, but from what I've seen, stdin is how your program will receive its input.
    When all else fails, read the instructions.
    If you're posting code, use code tags: [code] /* insert code here */ [/code]

Popular pages Recent additions subscribe to a feed

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21