This rule finds calls to the
gets function, which is dangerous and
should not be used. See Related
rules below for rules that identify other dangerous functions.
gets function is one of the vulnerabilities exploited by the Internet Worm of 1988, one of the first computer worms to spread through the Internet. The
gets function provides no way to limit the amount of data that is read and stored, so without prior knowledge of the input it is impossible to use it safely with any size of buffer.
Replace calls to
fgets, specifying the maximum length to copy. This will prevent the buffer overflow.
The following example gets a string from standard input in two ways:
The first version uses
gets and will overflow if the input
is longer than the buffer. The second version of the code
fgets and will not overflow, because the amount of data
written is limited by the length parameter.
Other dangerous functions identified by CWE-676 ("Use of
Potentially Dangerous Function") include
strcat. Use of these functions is highlighted by
rules for the following CWEs: