One of the most important rules, when developing networked code, is that your program should never trust the connected peer. Your code should never assume that the connected peer sends data in a particular format. This is especially vital for server code that may communicate with multiple clients at once.
If your code doesn't carefully check for errors and unexpected conditions, then it will be vulnerable to exploits.
Consider the following code which receives data into a buffer until a space character is found:
char buffer[1028] = {0};char *p = buffer;while (!strstr(p, " ")) p += recv(client, p, 1028, 0);
The preceding code works simply. It reserves 1,028 bytes of buffer space and then uses recv() to write received ...
