How is fgets safer ?

[broli86]

I have seen people saying fgets is safer to use than gets and it avoids buffer overflow. I want to ask how. code :

int getstring(char *s, size_t n, FILE *fp)
{
    char *p = NULL;

    if (fgets(s, n, fp) == NULL)
    {
        fprintf(stderr, "getstring failed\n");
        return (1);	   	
    }
    else
    {
        if ((p = strchr(s, '\n')) != NULL)
        {
            *p = '\0';
        }
    }    

    return (0);
}

int main(void)
{
    char s[20];

    if (getstring(s, sizeof s, stdin)
   {
       fprintf(stderr, "main failed\n");
       return (EXIT_FAILURE);
   }

    return (EXIT_SUCCESS);   
}

I tried to overflow the input string with more than 50-60 characters and absolutely no error message or anything was printed.

[Dino]

http://faq.cprogramming.com/cgi-bin/...&id=1043284351

[eXeCuTeR]

fgets is safer because you can tell how many bytes to read - it will read these bytes and stop reading no matters what opposing to gets/scanf while these functions read until they recognize an \n\r (if I'm not wrong)
Vulnerable prog:

char str[20]; // 20 bytes allocated on the stack
gets(str); // gets info from stdin to str
-> I'm allowed to enter MORE than 20 byte while more than 20 bytes will overflow the program (actually, 28 will overflow the EIP which is extremely dangerous if you are injecting a shellcode with it, 
and of course if it's a big application that can cause damage to the user if it's "well-exploited")

Basically, scanf/gets doesn't make any bounds checking, which makes them vulnerable.

This prog:

char str[20];
fgets(str, 20, stdin);

I will be able to enter more than 20 bytes but only 20 will be "accepted" and entered to str (In it doesn't matter how many bytes you are entering, eventually only 20 are accepted)


BTW,
I suggest you to run your vuln program with ollydbg/gdb and watch the registers when you try to overflow the program (read about different registers in google - focus on the EIP, which is the most important in ,the instructor pointer, the EBP, and ESP)


Your code is totally fine and safe.