c - gcc 为什么以及如何发出 gets() 警告？

Question

while(1)
    {
        printf("\nEnter message : ");
        gets(message);

        //Send some data
        if( send(sock , message , strlen(message) , 0) < 0)
        {
            puts("Send failed");
            return 1;
        }

        //Receive a reply from the server
        if( recv(sock , server_reply , 2000 , 0) < 0)
        {
            puts("recv failed");
            break;
        }

        puts("Server reply :");
        puts(server_reply);
    }

    close(sock);
    return 0;
}

这是我的计划的一部分。当我编译并运行它时，出现错误。错误消息是

warning: the gets function is dangerous and should not be used!

Answer 1

简单的谷歌搜索就会提供很多有用的信息，比如这个答案。

https://stackoverflow.com/a/1694042/2425366

使用gets的缓冲区溢出示例

#include <stdio.h>
#include <string.h>

int main(void) {
    char buff[15];
    int pass = 0;
    printf("\n Enter the password : \n");
    gets(buff);
    if (strcmp(buff, "thegeekstuff")) {
        printf("\n Wrong Password \n");
    }
    else {
        printf("\n Correct Password \n");
        pass = 1;
    }
    if (pass) {
        /* Now Give root or admin rights to user*/
        printf("\n Root privileges given to the user \n");
    }
    return 0;
}

输入1

thegeekstuff

输出

 Correct Password
 Root privileges given to the user

输入2

abcdefghijklmnopqr    <-- stack smashing

输出

 Wrong Password
 Root privileges given to the user