shell - C function read() leads to command injection -

i have kind of c code, , after first input, if enter big string, latter characters executed command in linux shell, can used command injection, i've found read() function main reason why happens, don't understand why, val int:

if (val > 0) {      struct in_addr *addr;     int addrmultval = val*sizeof(*addr);     char *buf2 = malloc(addrmultval);     (i = 0; < val; i++) {                      if (read(0, buf2, sizeof(*addr)) < 0) {             return 0;         }     }     done = 1; } 

your addrmultval variable has count size of type of addr, have sizeof(*addr)

your code, sizeof(addr), returning size of pointer, 4.

take note read() doesn't add '\0' terminate make string (just gives raw buffer).