The vulnerable function, in the form the question always poses it
The vulnerable function, in the form the question always poses it
Answer
int check_tag(void) { char str1[8], str2[8]; int valid = FALSE; next_tag(str1); gets(str2); if (strncmp(str1, str2, 8) == 0) valid = TRUE; return valid; }
Two defects on two lines. `gets(str2)` is unbounded by construction. `next_tag(str1)` is handed a pointer and no size, so it has the same problem — an answer that fixes only the first has fixed half the program.
Stallings & Brown 5e ch10 §10.1–10.2; ch11 §11.2