How to handle unknow size user input in C

Here are two examples to handle user input in C.

1. scanf

This method is easy get attack by buffer overflow, try input some characters which are more than what you declare to experience about what is buffer overflow.

#include 
#include 

int main()
{
    char bStr[80];
    printf("\nEnter a very very very long String value:");
    scanf("%s", bStr);
    printf("\nLong String value:%s \n\n",bStr);
    return 0;
}

2. fgets

This method can protect buffer overflow by limit the character user input.

#include 
#include 

int main()
{
    char bStr[80];
    printf("\nEnter a very very very long String value:");
    fgets ( bStr, 80, stdin );    
    printf("\nLong String value:%s \n\n",bStr);
    return 0;
}

However, above two methods only can handle normal user input, how about i want to handle user input with 1000 or even more characters? Yes, we can declare like “char bStr[1000]” or even more larger size, but this is not dynamic and flexible enough.

Solution

To fix it, uses realloc() to increase memory size dynamically. First let see what above scanf()buffer overflow look like, just input more than what you declare and see the result below.

Below example using dynamic memory allocation(realloc) in C to handle user input in unknown size.

#include 
#include 

int main()
{
    unsigned int len_max = 128;
    unsigned int current_size = 0;
    
    char *pStr = malloc(len_max);
    current_size = len_max;

    printf("\nEnter a very very very long String value:");

    if(pStr != NULL)
    {
	int c = EOF;
	unsigned int i =0;
        //accept user input until hit enter or end of file
	while (( c = getchar() ) != '\n' && c != EOF)
	{
		pStr[i++]=(char)c;

		//if i reached maximize size then realloc size
		if(i == current_size)
		{
                        current_size = i+len_max;
			pStr = realloc(pStr, current_size);
		}
	}

	pStr[i] = '\0';

        printf("\nLong String value:%s \n\n",pStr);
        //free it 
	free(pStr);
	pStr = NULL;


    }
    return 0;
}

Done, now the program can handle unknown size user input easily.