The Early Bug gets () the Internet Worm The problems in C are not confined to just the language. Some routines in the standard library have unsafe semantics. This was dramatically demonstrated in November 1988 by the worm program that wriggled through thousands of machines on the Internet network.

Understanding the Context

Why is gets() dangerous The first internet worm (the Morris Internet Worm) escaped about 30 years ago (1988-11-02), and it used gets() and a buffer overflow as one of its methods of propagating from system to system. The basic problem is that the function doesn't know how big the buffer is, so it continues reading until it finds a newline or encounters EOF, and may overflow the bounds of the ... Why is the gets function so dangerous that it should not be used? And the difference between gets/scanf and fgets is that gets(); and scanf(); only scan until the first space ' ' while fgets(); scans the whole input.

Key Insights

(but be sure to clean the buffer afterwards so you wont get an overflow later on) C - scanf () vs gets () vs fgets () - Stack Overflow 2 Why was the gets function removed instead of just changing its signature? At least in part because removing gets() from the language specification does not mean that implementations must remove it, only that providing it is no longer a conformance requirement. Why was the gets function removed instead of just changing its ... gets - Reads characters from stdin and stores them as a string. scanf - Reads data from stdin and stores them according to the format specified int the scanf statement like %d, %f, %s, etc.

Final Thoughts