TRT
Sign in
easyFoundationsconcept

Why is scanf("%s", buffer) dangerous?

Explain the buffer-overflow risk of unbounded string input and how to bound it with a field width or fgets.

TRT practice prompt — not a verified question from a named employer.

The Runtime Theory Team2 min read
Learn it firstC-Style Strings and Buffer BoundsUnderstand null-terminated byte strings, trace linear scans in strlen, and secure string operations against buffer overflows.

A strong answer

A strong candidate frames Why is scanf("%s", buffer) dangerous? around the exact memory layout, compiler semantics, and hardware execution model covered in C-Style Strings and Buffer Bounds. Explain the buffer-overflow risk of unbounded string input and how to bound it with a field width or fgets.

Unlike modern high-level languages, C does not have a native string data type. In C, a string is a contiguous sequence of characters terminated by a single zero byte: the null terminator ('\0').

Because strings are raw byte arrays without embedded length headers, software must rely entirely on that trailing zero byte to know where text stops.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

  • Mastery of core invariant: Contrast compile-time buffer capacity with runtime null-terminated string length.
  • Mastery of core invariant: Trace how string manipulation functions navigate memory up to the null byte sentinel.
  • Mastery of core invariant: Diagnose off-by-one allocation errors that omit space for the null terminator.
  • Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
  • Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

  • Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
  • Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
  • Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.

This answer walks

Practice follow-ups

  1. 01How does fgets differ from scanf with %s?
  2. 02What must you remember about the null terminator when bounding input?

More interviews in this topic

easy · languageWalk through the internal structure of a Go channel (`hchan`), explain the exact table of channel state behaviors (nil vs open vs closed for send, receive.easy · languageHow does Go's compiler decide whether a variable is allocated on the stack or the heap (Escape Analysis), why is returning a value `User` often faster than.easy · languageExplain how Go's Concurrent Tri-Color Mark-and-Sweep GC works—why doesn't Go use a compacting/generational GC like the JVM, how does the Hybrid Write Barrier.

Not started

Sign in to save your learning progress.

Sign in to save