From: J T Breitner <[email-masked]>
Date: Thu, 07 Sep 2000 20:16:32 EDT

On Thu, 7 Sep 2000 13:07:56 -0400 (EDT), Jaldhar H. Vyas [email-masked] wrote:

> I've run the c-client source through a scanner called its4 which looks for
> potentially insecure programming practices.  It was most unsettling.  Why
> in this day and age is there so much use of buffer overflow magnets like
> sprintf(3) and gets(3) etc?

They're used in this day and age because they work.  Sure, sprintf is potentially
dangerous when you're blindly manipulating data.  A
particularily bad use of sprintf is to use it to process something such as a raw
HTTP query string.  But then, a screwdriver is a dangerous tool too, especially if
you put the pointy end at your chest and run around in a dark room full of
furniture.  

Personally, I try to avoid both situations.

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------