🚀 go-pugleaf

In article <BzMzqC.n0u@jrd.dec.com> diamond@jit.dec.com (Norman Diamond) writes:
>Remember, a language with gets() and other such niceties is intended for
>hacking, not for security.  The "N" is intended to bring over a known portion
>of the source string, not to protect other stuff near the target.  Now this
>raises the question of why memcpy() was invented, and I don't know the answer.
>
>On a more serious note, people actually do use gets().  I'd worry about this
>kind of dangerous stuff long before caring about silly things like strncat().

I think Norman made a very good point here.  If in your C-library `gets'
is a single module (I just checked and at least in UNIX SysV.R3 it seems
to be so) you have a choice:  Pull this module out of the library and
into a new one (say, "/lib/libdangerous.l").  So programs using gets
will have an `unresolvable external'.  This should help to alert people
that they should change their programs.  (And if they are desperate they
can still link the programs by adding "-ldangerous" to the cc command line.)
-- 
Martin Weitzel, email: martin@mwtech.UUCP, voice: 49-(0)6151-6 56 83