From: Jamis Buck Date: 2004-08-28T12:54:10+09:00 Subject: Re: performance comparison David Ross wrote: > Its common security knowledge gets() is unsafe. It has > no bounds checking. I only talk about security and > ease of use. Its the only thing I like to talk about. > :) > > I love security. > > from my manpages-- SECURITY CONSIDERATIONS > The gets() function cannot be used securely. Because > of its lack of > bounds checking, and the inability for the > calling program to reliably > determine the length of the next incoming line, > the use of this function > enables malicious users to arbitrarily change a > running program's func- > tionality through a buffer overflow attack. > To clarify, then: David, you are talking about the C 'gets()' function, correct? I agree that it should be avoided at all costs. However, Ruby's "gets()" function does not map directly to a C "gets()" invocation -- it does a lot more work, including bounds checking. Thus, saying "gets() is unsafe in every language" is rather misleading. I won't say it is "safe" in Ruby, since I'm not an expert in this area, but it is certainly not as hazardous to use as in vanilla C code. (Someone please flame me gently if I've mispoken anything grossly regarging Ruby's internals...) - Jamis > > --------- > > There are many other insecure function calls. The > knowledge on how to use them properly is very nice to > have. Which most people lack. Also using printf() for > certain types of usage can lead to exploits. buffer > overflow problems, etc. > > btw, I am a BSD dragon. So expect to get information > like this from me ;) > > I bite, be careful > > --David Ross > > --- Mikael Brockman wrote: > > >>David Ross writes: >> >> >>>Yes, that is the 20 million story. I smile at that >> >>one >> >>>still. Someone please fwap() me if I ever make a >>>release with a bug like that :) >>> >>>It is equally important in any language that >> >>mistakes >> >>>are not made like this. They are very dangerous. I >> >>am >> >>>curious on the print functions in Ruby as to if >> >>the >> >>>ones that are unsafe to use in certain >> >>applicatoins >> >>>are equally unsafe in Ruby. Of course gets() is >>>unsafe, it is in every language. >> >>Huh? Why? >> >> >> > > > > > > _______________________________ > Do you Yahoo!? > Win 1 of 4,000 free domain names from Yahoo! Enter now. > http://promotions.yahoo.com/goldrush > > . > -- Jamis Buck jgb3@email.byu.edu http://www.jamisbuck.org/jamis "I use octal until I get to 8, and then I switch to decimal."