64 The traps of reading and writing — <stdio.h> ②

64.1 The death of gets and its successors

The hole the 1988 internet worm bored into was exactly this function (chapter 43). Today gets is not in the standard, and three remain in its place.

fgets is the right answer, but it is not the end in itself. As seen in chapter 63, if the buffer is too small it quietly reads only the front piece.

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

/* Two safe ways of reading a line, and the difference between them */

static const char *PATH = "reading_demo.txt";

static void make_file(void)
{
    FILE *f = fopen(PATH, "w");
    if (!f) return;
    fputs("short\na line that is definitely too long\nend\n", f);
    fclose(f);
}

/* (1) a fixed buffer plus a truncation check */
static void read_fixed(void)
{
    char buf[8];
    FILE *f = fopen(PATH, "r");
    if (!f) return;
    while (fgets(buf, sizeof buf, f)) {
        int complete = strchr(buf, '\n') != NULL;
        if (complete) buf[strcspn(buf, "\n")] = '\0';
        printf("  [%s]%s\n", buf, complete ? "" : "   <- truncated (the line continues)");
    }
    fclose(f);
}

/* (2) growing as needed while reading — with standard functions alone */
static char *read_line(FILE *f)
{
    size_t cap = 8, len = 0;
    char *buf = malloc(cap);
    if (!buf) return NULL;

    int c;
    while ((c = fgetc(f)) != EOF && c != '\n') {
        if (len + 1 >= cap) {
            char *nbuf = realloc(buf, cap * 2);
            if (!nbuf) { free(buf); return NULL; }  /* even on failure the original survives */
            buf = nbuf;
            cap *= 2;
        }
        buf[len++] = (char)c;
    }
    if (c == EOF && len == 0) { free(buf); return NULL; }
    buf[len] = '\0';
    return buf;
}

int main(void)
{
    make_file();

    printf("a fixed 8-byte buffer:\n");
    read_fixed();

    printf("growing while reading:\n");
    FILE *f = fopen(PATH, "r");
    if (f) {
        char *line;
        while ((line = read_line(f)) != NULL) {
            printf("  [%s] (%zu bytes)\n", line, strlen(line));
            free(line);
        }
        fclose(f);
    }
    remove(PATH);
    return 0;
}

a fixed 8-byte buffer:
  [short]
  [a line ]   <- truncated (the line continues)
  [that is]   <- truncated (the line continues)
  [ defini]   <- truncated (the line continues)
  [tely to]   <- truncated (the line continues)
  [o long]
  [end]
growing while reading:
  [short] (5 bytes)
  [a line that is definitely too long] (34 bytes)
  [end] (3 bytes)

The difference between the two approaches is clear. The fixed buffer split the long line into five pieces, while the edition that reads while growing returned the 34-byte line whole.

The rules for reading code come to three in the end.

1. Turn the loop on fgets’s return value (whether it is null).
2. Check whether the line read has a newline and judge whether it was truncated.
3. Erase the newline with buf[strcspn(buf, "\n")] = '\0'; — this idiom is safer than hand-written code based on strlen.

char name[32];
scanf("%s", name);        /* exactly the same danger as gets */

64.2 The remaining traps of formatted input

Chapter 61 took the grammar apart, so here we gather only the places where accidents happen.

First, not checking the return value. The scanf family returns the number of items filled. Without checking it you end up using the previous value of the variable that failed (we see it in the flesh in chapter 85).

Second, leftover input. After scanf("%d", &n) a newline remains in the input buffer. Call fgets in that state and it reads an empty line. Not mixing them is the best policy, and if you must mix, empty the rest of the line and move on.

Third, integer overflow. Give 99999999999 to a %d and it is outside the contract. If the range must be checked, read with strtol (chapter 66).

Fourth, %s and the locale. The definition of whitespace may change with the locale (chapter 67).

int need = snprintf(buf, sizeof buf, "%s/%s", dir, name);
if (need < 0 || (size_t)need >= sizeof buf) {
    /* truncated — this path must not be used as it is */
}

64.3 The traps on the output side

printf’s return value — code that checks it is rare, but it fails in the situation of a broken pipe (program | head, say). For a program that keeps logs there is a value worth checking.

The format string vulnerability — the one treated in chapter 61. The rule is one. The format string must always be a constant written by the program.

%n — the conversion that writes the number of characters printed to where the argument points. Being the passage that promotes a format string vulnerability into an arbitrary memory write, several implementations block it by default today. There is almost no reason to use it.

Buffering and order — mix printf (standard output, usually line-buffered) with fprintf(stderr, ...) (mostly unbuffered) and the order in which things appear on the screen can be reversed. Half of the occasions on which “the output vanished” during debugging are this, and the other half are cases where the buffer was not emptied just before a collapse.

64.4 The remaining functions that handle files

tmpnam is in the standard, but not using it is the right answer — because another program can slip in between the returning of the name and the creating of a file with that name (the class of race called TOCTOU). Within the standard tmpfile is the answer, and if a platform API is permitted, mkstemp (POSIX).

We have crossed the minefield of input and output. The next chapter is another minefield just as famous — the string functions.