Re: Fwd: Re: Shell-Creation. A simulation Code

["Binand Raj S." <binand@xxxxxxxxxxxxxxxxxxxxx>]

Kapil Bhalla wrote:

> #include<stdio.h>
> int  main()
> {
>         do {
>                         char *str;
>                 printf("command:>");
>                 gets(str);
>                 if (strcmp(str,"exit")==0)
>                         exit(0);
>                 system(str);
>           } while 1;
>                         exit(0);
> }
> This will not give any warning.

It might not, but it is sure a candidate for buffer overflows. gets()
reads into str, for which there is no memory allocated.

Seg faults and/or another exploit is the outcome. Plus the usual flaws
associated with system().

Binand

>