It has been a while since the last bug was up. We certainly had some great discussion around it. I will try to get more bugs up on the site on a regular basis to keep everyone on their toes at all times :-)
Courtesy of Neelay Shah, Consultant (Foundstone)

#define MAX_STR_LEN     255

            :

            :

            :

      char strUserInput[MAX_STR_LEN+1];

      scanf(“%s”, &strUserInput);

            :

            :

            :

 

Solution       

 

#define MAX_STR_LEN     255

            :

            :

            :

      char strUserInput[MAX_STRING_LEN+1];

      fgets(strUserInput,MAX_STR_LEN+1,stdin);

            :

            :

            :

                       

Everyone figured out that in the bad way of programming the ‘scanf()’ function is used to read the user input from the console. Now, scanf() does not check for the length of the input string and if a malicious user enters a string longer than the maximum length it will lead to overwriting the memory following ‘strUserInput’.  There is more than one good way to fix this. In our solution, we use the ‘fgets()’ function to read the user input and using which you can control the maximum length of the user input. This is a case of buffer overflow and perhaps easy but I added it because I think it is still very prevalent.