gets is a function in the C standard library, declared in the header file stdio.h, that reads a line from the standard input and stores it in a buffer provided by the caller.

Use of gets is strongly discouraged. It is left in the C89 and C99 standards for backward compatibility. Many development tools such as GNU ld emit warnings when code using gets is linked.

Implementation

It might be implemented as follows (using getchar):

char *gets(char *s) {

} The programmer must know a maximum limit for the number of characters gets will read so he can ensure the buffer is big enough. This is impossible without knowledge of the data. This design flaw leads to bugs and opens a gate for exploiting computer security through a buffer overflow. Many sources advise programmers to never use gets in new programs.

Alternatives

Other line input functions may be used instead of gets, so as to avoid buffer overflow bugs. A simple alternative is fgets. When replacing code of the form

char buffer3; gets(buffer); with code of the form char buffer4; fgets(buffer, sizeof(buffer), stdin);

one must keep in mind that the fgets(buffer, sizeof buffer, stdin) call differs from gets(buffer) not only in buffer overflow protection, but also in that fgets(buffer, sizeof buffer, stdin) preserves the terminating newline (if the input line is terminated by a newline), while gets(buffer) discards it.

Safe use

Safe use of gets requires the programmer to ensure that buffer overflows cannot be a problem. Standard C provides no way to do this; however, there are a number of relatively complicated ways to ensure it, with varying degrees of portability. One possibility is to use a guard page to protect memory. Alone, this turns exploitable buffer overflows into mere crashes. In combination with an exception handler, such as one involving SIGSEGV and sigaction, the guard page can allow graceful error handling.

References