How to prevent buffer overflow attack?

Question

int main(void) {
    char buff[15];
    int pass = 0;
    printf("\n Enter the password : \n");
    gets(buff);
    if (strcmp(buff, "thegeekstuff")) {
        printf("\n Wrong Password \n");
    }
    else {
        printf("\n Correct Password \n");
        pass = 1;
    }
    if (pass) {
        /* Now Give root or admin rights to user*/
        printf("\n Root privileges given to the user \n");
    }
    return 0;
}

i know I have to change pass so it wont allow a non-zero value to get through but how do i do that?

Answer 1

gets() does not limit its input, it is impossible to use securely.

I'd suggest to use

fgets(buff,15,stdin);

instead of gets.

Other solutions may exist.

Answer 2

Declare char buffer after any other type of declaration, even in structs, because char buffer can overwrite the allocation space of the other variables at run time. Always fill buffer with zeroes (memset), before using it and initialize (set to zero or a predefined value) any other variable after declaration. Use fgets as suggested, when you know exactly the dimension of you array and use strncmp, instead of strcmp, for the same reason.