sscanf with %s or %[ is equivalent to strcpy but often gets a pass in audits from people who would never let a strcpy slidehttps://twitter.com/marcan42/status/1008981518159511553 …
It's much worse - closer to gets(). With fscanf it's the same. With sscanf, if you could have easily measured the field already you probably wouldn't be using sscanf.
-
-
Indeed. And if you want to do a bounded copy into a 8 byte buffer, and you use %8s, you have an off by one overflow for the NUL byte. And there’s also the possibility of format string bugs. Truly a terrible set of APIs
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Any good audit should flag *scanf %s or %[ without a field width limit as serious bug.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.