How to prevent scanf causing a buffer overflow in C?

by

In their book The Practice of Programming (which is well worth reading), Kernighan and Pike discuss this problem, and they solve it by using snprintf() to create the string with the correct buffer size for passing to the scanf() family of functions. In effect:

int scanner(const char *data, char *buffer, size_t buflen)
{
    char format[32];
    if (buflen == 0)
        return 0;
    snprintf(format, sizeof(format), "%%%ds", (int)(buflen-1));
    return sscanf(data, format, buffer);
}

Note, this still limits the input to the size provided as ‘buffer’. If you need more space, then you have to do memory allocation, or use a non-standard library function that does the memory allocation for you.

Note that the POSIX 2008 (2013) version of the scanf() family of functions supports a format modifier m (an assignment-allocation character) for string inputs (%s, %c, %[). Instead of taking a char * argument, it takes a char ** argument, and it allocates the necessary space for the value it reads:

char *buffer = 0;
if (sscanf(data, "%ms", &buffer) == 1)
{
    printf("String is: <<%s>>\n", buffer);
    free(buffer);
}

If the sscanf() function fails to satisfy all the conversion specifications, then all the memory it allocated for %ms-like conversions is freed before the function returns.

More Related Contents:

  1. decimal of numbers in c
  2. scanf() not taking input from console [closed]
  3. C program goes into infinite loop with scanf [duplicate]
  4. fgets doesn’t work after scanf [duplicate]
  5. Why is scanf() causing infinite loop in this code?
  6. What can I use for input conversion instead of scanf?
  7. Why does scanf() need “%lf” for doubles, when printf() is okay with just “%f”?
  8. scanf Getting Skipped [duplicate]
  9. C – scanf() vs gets() vs fgets()
  10. C skipping one command of a function? [duplicate]
  11. abnormal behavior of scanf [duplicate]
  12. using scanf(“%d “) with a space after the %d
  13. Difference between scanf and scanf_s
  14. Read no more than size of string with scanf()
  15. Why does scanf fail with floats?
  16. Why scanf must take the address of operator
  17. fgets instructions gets skipped.Why?
  18. Input in C. Scanf before gets. Problem
  19. How do we test the return values from the scanf() function?
  20. Reading a string with spaces with sscanf
  21. Whitespace before %c specification in the format specifier of scanf function in C
  22. How to read from input until newline is found using scanf()?
  23. How can I prevent scanf() to wait forever for an input character?
  24. How to determine the size of an allocated C buffer? [duplicate]
  25. Scanf causes C program to crash
  26. using scanf function with pointers to character
  27. How can I fix the scanf to take data into the array?
  28. Wrong format specifiers in scanf (or) printf
  29. C: How can I make it so scanf() input has one of two formats?
  30. Difference between scanf() and fgets()

Leave a Comment