🚀 go-pugleaf

spacefox@acs.bu.edu (Godfrey Degamo) writes:
: 
: 
: This was posted awhile ago:
: -------------------------------------------------------------------------------
: In article <BzMzqC.n0u@jrd.dec.com> 
: diamond@jit.dec.com (Norman Diamond) writes:
: Remember, a language with gets() and other such niceties is intended for
: hacking, not for security.  The "N" is intended to bring over a known portion
: of the source string, not to protect other stuff near the target.  Now this
: raises the question of why memcpy() was invented, and I don't know the answer.
: 
: On a more serious note, people actually do use gets().  I'd worry about this
: kind of dangerous stuff long before caring about silly things like strncat().
: -------------------------------------------------------------------------------
: 
:      I am  a person who programs in C for recreation.  -much technical jargon 
: is beyond my comprehension.  Perhaps you can answer my two questions.
: 
:      I would like to know why it's "dangerous" to use gets().  I always
: make certain I pass in the name of a char array or some pointer char that
: has been allocated some memory.  It always seems to work for me.

The "danger" in get() is common to a large number of routines.  There is an
axiom that is never taught, that one should only use routines that write to
arrays FOR WHICH THE LENGTH OF THE ARRAY IS SPECIFIED.  The problem is that
with gets and strcat and several other routines, you pass the address of a
destination array and it fills it up.  If things are not the way you expect at
the time you write the program (for example, if the user types a line longer
than you expected), you will keep right on going past the end of the array, and
write all over other variables (or worse).  Everyone I know who implicitly
understands this rule learned it the hard way.  Usually more than once.

:      What other alternative is there for one to use?  I try to find some
: other way of getting user input other than scanf().  I seem to have problems
: with scanf.  For instance:
: 
:      scanf ("%s", &inputA);
:      scanf ("%s", %inputB);
: 
:      What happens is that inputA gets the user input, then when the computer
: comes to the second line, it reads the CR from the first input as the input
: for inputB.  (I don't remember this: but, I think that I tried a variation
: "%s\r" and it still wouldn't work.)  Anyways, things like this where the
: input of one is "leaked" to the next seem to crop up when I use scanf.
: So, that's why I avoid it.  For numerical input, I use gets() and then
: call a number conversion function.
: 

It is also an axiom never to use scanf.  Many programmers use gets or fgets
and then sscanf, many write their own parse routines each time.

:      My next question is this:
: 
:      Let's say I have a database program that holds information about people;
: address, telephone number, physical description.  All the data of all the
: people is saved to one file.
:      How do I modify then save the records of one person without loading up
: all the data then saving all the data, which can be very slow when the file
: gets large?
:      I thought of scanning through the file until I get to the record to be
: changed.  And from there, start saving the data, but I'm worried that I will
: overwrite other records if the amount of data is larger then the old data.
:      It's been awhile since I programmed in AppleSoft Basic, but in it, there
: is the concept of Random Access Files and Sequential Files.  In Random 
: Access Files, you can do what I just desribed to you, but each record has to
: be a set size.  Sequential Files could be anysize, but you lose the ability
: to save information without loading all the data into memory.
:      Is there something similar to this in C/Unix or C/MS-DOS?

Yup.  Identical.  If you make the records all the same size (obviously, it will
need to be large enough to hold everything you might want to say), then you can
update them without growing.  You can also compute where the beginning of a
record is.  This allows accessing the records in random order, hence the term
Random Access.  If you are only going to access the records sequentially, you
will never need to compute the address of a record.  They can therefore be
varying in size.  They can be updated in place, but if they need to be bigger,
you either have to "move" everything after, or mark that record as deleted and
tack the bigger one on the end.

The concept is a universal one.  It is implementation you wanted to ask about.
In C, fseek() and ftell() are the functions you are interested in.  fseek()
will let you know the location of a record in a file, and ftell() will go to a
predetermined address.  It is O/S dependent what the arguments to these
functions, and their return values, should be.  (and on VAX/VMS, you could do
it this way, but RMS has certain advantages too, and should be considered.)

:      If you don't have the time to answer my second question, could you
: please point me to some C literature that does?
: 
: Also, if you do respond, I suppose it would be nice to post on this group,
: (if it's not so trivial.)  but I don't read these C programming newsgroups
: often and might forget I posted here!  So, please could you mail your
: answers to me?
: 
Anything to help.  However, if it is not worth your time to read the group
where you posted the question, I find it insulting that you think it is worth
my time to not only read your worthless question but to consider spending my
time to consider it and respond.  If the question is of general interest, and
the answer is as well, then news is the place for it.  If the question is made
public because the answer which is not generally interesting is simply
difficult to find, then email is the place.  However, your statements boil down
to "I have a question which I think everyone wants to know the answer to.
So please answer it publicly.  However, I'm too lazy to get up and read the
bulletin board, so send it by mail, because mail is delivered to my desk."

I'm sorry if this seems harsh; I've simply reached my tolerance for this
particular implied insult.  I'm sure you didn't intend it that way, nor did any
of the others.  But I find no moral difference between this scenario and
calling someone up to ask a question, and finishing with "I don't have time to
listen to the answer, so write me a letter.  But I need to know right away".

: 
: Thanks for listening, sorry to waste your time, have a good day.
: 
:                                         -G. Degamo,
:                                          spacefox@acs.bu.edu
-- 
Steve Suttles                Internet:  steve@dbaccess.com      Dr. DCL is IN!
CROSS ACCESS Corporation     UUCP: {uunet,sgiblab}!troi!steve  Yo speako TECO!
2900 Gordon Ave, Suite 100   fax: (408) 735-0328              Talk data to me!
Santa Clara, CA 95051-0718   vox: (408) 735-7545   HA! It's under 4 lines NOW!