02 C Programming User Input Tutorial GCC

[MauroScomparin]

I think the last char in a c string or char[] or *char should be a null byte ('\0') to end the string in the array (contiguous memory addresses) so "hello" is really a char pointer to an array like this ['h', 'e', 'l', 'l', 'o', '\0']. fgets just reads until the number of characters specified -1 or a new line or a null byte if it's smaller. It then substitute it with a '\0' to end the string in the array. Gotta love pointers in c.. Nasty but powerful :D
Great idea with the example with gets to show how nasty it could get. Looking forward for more, it's always nice to see stuff explained so clearly!

[DDBAA]

If you leave the extra space and use the 'gets' function instead of 'fgets' , can someone use the extra space to get command injection? or is the vuln just a buffer overflow ? Meaning I know they would be over allocating to the stack I am just curious what type of payload you can inject this way. Does it JUST crash the application or would you be able make system calls later . What can it see if you could get injection, would the attacker encode it? Llets say it asks for the 3 letters and then i give it FBK' or FBK;<payload>, so your saying with 'gets' ← that FBK scenario could be possible & thats why it warns you ? So you use 'fgets' so you can allow user input to be as long as needed or 20 letters whatever comes first.. Just want to make sure I am understanding . Really Looking forward to part 3