There is a significant difference between gets() and fgets(). The following function prototypes for these two functions highlight their differences:
char* gets( char* str );
char* fgets( char* str , int size , FILE* stream );
From this, we see that gets() requires no limits on how many characters it reads; therefore, gets()has the potential to read an infinite amount of input. On the other hand,fgets()must be given a maximum number of characters to be read in the size parameter. fgets() will read up to size-1 characters unless EOF or <newline> are encountered.
Because there are no limits on the length of the string to gets(), it has the potential to read beyond the size of the string buffer. If this happens, in a best-case scenario, mayhem will ensue and the program will crash. In a worst-case scenario, malicious input could be devised such that the program does not crash and causes control to extend...
